CVE-2026-121421
Deferred Deferred - Pending Action

SurrealDB Network Capability Bypass via SSRF

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: VulnCheck

Description
SurrealDB 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability in network-capability matching because port-specific --deny-net rules (HOST:PORT or IP:PORT) match only a literal host string, while the resolved-IP check discards the port. Authenticated users can call http::* functions with a hostname resolving to a denied IP, or the IP of a denied hostname, to reach blocked internal services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-121421
EUVD
EUVD-2026-115953

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
surrealdb surrealdb 3.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in SurrealDB versions 3.1.0 to 3.2.9. It allows authenticated users to bypass port-specific network deny rules by using hostnames that resolve to denied IPs or IPs of denied hostnames. The issue occurs because port-specific rules only match literal host strings, while resolved-IP checks ignore ports.

Detection Guidance

To detect this vulnerability, check SurrealDB versions between 3.1.0 and 3.2.9. Run commands like 'surreal version' or inspect package metadata. Test network rules by attempting to access internal services via host aliases or IP forms of denied hostnames.

Impact Analysis

An attacker with authenticated access could bypass network restrictions to reach internal services that were meant to be blocked. This could lead to unauthorized access to sensitive data or internal systems, depending on the configuration of the SurrealDB instance.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) or HIPAA (health information privacy). Organizations using affected versions may fail to meet data access control obligations.

Mitigation Strategies

Upgrade SurrealDB to version 3.3.0 or later immediately. Review and update --deny-net rules to ensure they cover all host representations. Restrict authenticated user access to http::* functions until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121421. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...