Disclosed weakness · no CVE recorded

Escaped identifiers can inject SurrealQL through SurrealDB’s MCP tools

SurrealDB · SurrealDB MCP server

First documented disclosure · Review checkpoint

Summary

A caller can turn an MCP record or table identifier into an additional database statement.

Severity and exploitation evidence

High · numeric CVSS score not recorded. Severity source.

Exploitation not established: The maintainer confirms the injection path. No malicious use or production victim was identified.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The tool’s identifier validator and the SurrealQL parser disagree about escaped backticks. Text accepted as one identifier can change the structure of the generated query.

Conditions required

The caller can invoke the affected MCP tool and supply its identifier argument. Database privileges bound what the resulting statement can do.

Potential impact

Execution of caller-controlled SurrealQL outside the configured tool’s intended query. The advisory does not demonstrate escalation beyond the database session.

Affected versions and configurations

The maintainer advisory lists the MCP integration before 4.0.0.

Fix and mitigation status

4.0.0 contains a matching identifier validation fix.

Practical next steps

Update to a release containing the 4.0.0 fix and restrict the database role used by MCP sessions.

Operating lesson

Test model-supplied identifiers against the database parser’s actual escape rules.

Evidence and limits

The advisory and public 4.0.0 release are dated November 3. The linked patch carries an October 21 commit timestamp. Its public availability on that earlier date was not established. The advisory assigns a High rating with no numeric CVSS or CVE.

Sources