SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization
Date: 2026-07
Affected: rust/surrealdb
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Medium
CWE: CWE-862
CWE-863
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)

An anonymous caller could create new namespaces and databases on a running SurrealDB instance without holding `DEFINE NAMESPACE` or `DEFINE DATABASE` permission. `USE NS <name>` and `USE DB <name>` automatically create the target when it does not exist. The three places `USE` is handled — the RPC `use` method, `Datastore::process_use`, and the SurrealQL executor — did not check whether the caller was allowed to create the resource. Under default capabilities any session reached this path, including an unauthenticated guest. ### Impact What an attacker **can** do: - Create new namespaces and databases without `DEFINE NAMESPACE` / `DEFINE DATABASE` permission. An unauthenticated guest is enough under default capabilities. - Recreate a parent namespace that an operator deliberately dropped, using a stale namespace-Editor token, by running `USE NS <dropped> DB anything`. - Exhaust catalog storage by repeatedly creating new resources. What it **can't** do: - Read or modify data inside any pre-existing namespace or database. - Escalate to root or namespace-owner privileges on existing resources. - Affect deployments running with `auth_enabled=false`. ### Patches All three `USE` entry points now check whether the caller has `DEFINE NAMESPACE` / `DEFINE DATABASE` authority before creating a missing target. Sessions still update their context regardless of authorization, so SDKs that send `use` before `signin` continue to work — only the catalog creation step is gated. The par


Mitigations:

Architectural layers (MAESTRO):