—

PYSEC-2026-3718

빠른 조치

PYSEC-2026-3718 — surrealdb: 아래 명령으로 수정 버전으로 올리세요.

pip install --upgrade 'surrealdb>=1.0.1'

상세

SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions. Attackers with database access or unauthenticated users on publicly exposed instances can perform unrestricted operations on unprotected tables within their authorization scope.

이 버전이 영향받나요?

사용 중인 패키지 버전을 입력하면 즉시 평가합니다.

영향 패키지

PyPI / surrealdb

최초 영향 버전: 0 수정 버전: 1.0.1

수정 pip install --upgrade 'surrealdb>=1.0.1'

참고

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-x5fr-7hhj-34j3 [ADVISORY]
https://www.vulncheck.com/advisories/surrealdb-before-insecure-default-table-permissions [ADVISORY]