{"id":"CVE-2026-121419","aliases":["GHSA-pgh9-49q4-hqcx"],"url":"https://o3.security/vulnerability/CVE-2026-121419","summary":"SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collision","details":"SurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where the MCP BoundSubject fingerprint uses the access method name instead of per-user identity for JWT/Bearer access. Attackers with a valid low-privilege token for the same access method and a victim's mcp-session-id can hijack the session and execute MCP tools with the victim's roles and permissions.","published":"2026-11-03T14:28:16.612Z","modified":"2026-11-04T02:47:29.944936680Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/121xxx/CVE-2026-121419.json"},{"type":"ADVISORY","url":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-pgh9-49q4-hqcx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121419"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/surrealdb-3.1.0-before-3.3.0-mcp-session-hijack-via-boundsubject-collision"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-04T02:47:29.944936680Z"}}