Medium severity · published Sep 26, 2025
CVE-2025-11060
Surrealdb: surrealdb is vulnerable to unauthorized data exposure via live query subscriptions
5.7
CVSS
0.3%
EPSS
No
On KEV
Description
A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or guest users to observe unauthorized records within the same table, bypassing access controls, via crafted LIVE SELECT subscriptions when other users alter or delete records.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
OpenShift Service Mesh 3 · Red Hat
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-11060
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-11060
access.redhat.com
https://access.redhat.com/security/cve/CVE-2025-11060
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2394708
github.com
https://github.com/surrealdb/surrealdb
github.com
https://github.com/surrealdb/surrealdb/commit/d81169a06b89f0c588134ddf2d62eeb8d5e8fd0c
github.com
https://github.com/surrealdb/surrealdb/pull/6247
github.com
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-7vm2-j586-vcvc
More from OpenShift Service Mesh 3
9.9
CVE-2025-62718
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
8.8
CVE-2026-27140
Code execution vulnerability in SWIG code generation in cmd/go
8.5
CVE-2026-92982
Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection
3.7
CVE-2025-8556
Github.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect results