What happened
SurrealDB's MCP BoundSubject fingerprinting uses the access method name rather than per-user identity for JWT/Bearer access, so sessions are scoped to an access method rather than a distinct identity. A low-privileged token for the same access method plus a victim's mcp-session-id lets an attacker hijack the session and run MCP tools with the victim's roles and permissions. CVSS 8.1 (3.1) / 8.6 (4.0), HIGH; published 2026-11-03.
Why it matters
SurrealDB exposes an MCP server that LLM agents call to query and mutate data. A session-hijack that lets an attacker act as a higher-privileged user across the MCP tool surface means an agent's database actions can be redirected or escalated — a direct compromise of the data/agent boundary in AI deployments that rely on SurrealDB's MCP integration.
Attack vector
Improper authentication in the MCP integration: the MCP BoundSubject fingerprint is derived from the access-method name rather than the per-user identity. Because the fingerprint is not unique per user, an attacker holding a valid low-privilege token for the same access method can combine it with a victim's mcp-session-id (obtained or guessed) to be treated as the victim and invoke the MCP tool surface with the victim's roles and permissions.
Affected systems
SurrealDB (surrealdb, Rust crate) 3.1.0 <= x < 3.3.0
Mitigation
Upgrade to SurrealDB 3.3.0. Vendor advisory: https://github.com/surrealdb/surrealdb/security/advisories/GHSA-pgh9-49q4-hqcx