SurrealDB 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability in network-capability matching because port-specific --deny-net rules (HOST:PORT or IP:PORT) match only a literal host string, while the resolved-IP check discards the port. Authenticated users can call http::* functions with a hostname resolving to a denied IP, or the IP of a denied hostname, to reach blocked internal services.
Metrics
Affected Vendors & Products
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 03 Nov 2026 14:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | SurrealDB 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability in network-capability matching because port-specific --deny-net rules (HOST:PORT or IP:PORT) match only a literal host string, while the resolved-IP check discards the port. Authenticated users can call http::* functions with a hostname resolving to a denied IP, or the IP of a denied hostname, to reach blocked internal services. | |
| Title | SurrealDB 3.1.0 before 3.3.0 SSRF via Port-Specific --deny-net Host Aliasing Bypass | |
| First Time appeared |
Surrealdb
Surrealdb surrealdb |
|
| Weaknesses | CWE-918 | |
| CPEs | cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Surrealdb
Surrealdb surrealdb |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-11-03T14:28:18.001Z
Reserved: 2026-11-03T12:29:41.359Z
Link: CVE-2026-121421
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-11-03T15:17:32.340
Modified: 2026-11-03T15:17:32.470
Link: CVE-2026-121421
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses