CVE-2026-121420
Deferred Deferred - Pending Action

SurrealDB SSRF via Unwrapped IPv6 Transition Addresses

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: VulnCheck

Description
SurrealDB from 3.2.0 before 3.3.0 contains a server-side request forgery vulnerability in the FilteringResolver is_private_ip check that fails to unwrap NAT64, 6to4, and Teredo IPv6 addresses. Authenticated users triggering outbound HTTP requests via SurrealQL http functions can use transition addresses embedding private IPv4 targets to reach localhost, internal services, or cloud metadata endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-121420
EUVD
EUVD-2026-115952

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
surrealdb surrealdb 3.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Server-Side Request Forgery (SSRF) flaw in SurrealDB versions 3.2.0 to 3.2.9. The is_private_ip function fails to properly handle IPv6 transition addresses like NAT64, 6to4, and Teredo, which embed private IPv4 targets. This allows bypassing SSRF protections to access localhost, internal services, or cloud metadata endpoints via outbound HTTP requests.

Detection Guidance

To detect this vulnerability, check if your SurrealDB version is between 3.2.0 and 3.2.9. Use commands like 'surrealdb version' or inspect package metadata. Monitor outbound HTTP requests from SurrealQL http functions for IPv6 transition addresses (NAT64, 6to4, Teredo) embedding private IPv4 targets.

Impact Analysis

Authenticated users can exploit this to send unauthorized HTTP requests to internal systems or cloud metadata services. This could lead to data exfiltration, internal service compromise, or unauthorized access to sensitive endpoints like cloud provider metadata APIs.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements for protecting sensitive health information. Organizations may face compliance violations if exploited.

Mitigation Strategies

Upgrade SurrealDB to version 3.3.0 or later immediately. If upgrading is not possible, restrict outbound HTTP requests via network policies or firewall rules. Disable SurrealQL http functions if unused. Monitor for suspicious outbound traffic patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121420. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...