SurrealDB MCP sessions could inherit another user’s authorization context

SurrealDB disclosed an MCP session isolation flaw tracked as GHSA-pgh9-49q4-hqcx. Where different users shared an access-method name, the session fingerprint could be based on that method instead of the specific validated JWT identity. In an affected setup, an attacker with a valid lower-privilege token and the session identifier of a more privileged connection could collide with that authorization context. The vendor documents a fix in version 3.3.0.

This is an identity-binding defect in the tool transport, not proof that a model decided to escalate its own permissions and not a disclosed production compromise. It matters for AI agents because tool hosts often maintain sessions that outlive individual calls: if the transport mixes principals, later tool requests may be evaluated against the wrong identity. Maintainer advisory.

The advisory was published on October 19, 2026, rather than November 3. Its structured package range lists versions from 3.1.0 up to, but not including, 3.3.0, while the detailed description names MCP HTTP transport from 3.2.0 onward. That discrepancy needs a deployment-specific version check; the report reproduces seven of seven checks against a released 3.2.0 binary and a 3.3.0 nightly source revision. The patched release is listed as 3.3.0. Original advisory.

A victim session identifier and a lower-privilege valid credential are prerequisites in the described route. This is not an anonymous takeover, and the presence of an MCP interface does not make it an LLM prompt-injection attack. The authorization collision happens during backend session binding. It differs from wrong-audience MCP token acceptance, where token scope validation is the disputed boundary. Both demand principal-specific authorization at actual tool dispatch.