CVE-2025-71390
Received Received - Intake

SurrealDB DNS Bypass in http Functions

Publication date: 2026-07-18

Last updated on: 2026-07-18

Assigner: VulnCheck

Description
SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames against --deny-net network access restrictions in its http::* functions. An authenticated user can invoke http::<fn>(<url>) with a hostname that resolves to a denied IP address, causing the server to issue the request anyway and return the response. This bypasses network access controls, allowing access to restricted internal endpoints and potentially retrieving or altering sensitive information and credentials, depending on the deployment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-18
Last Modified
2026-07-18
Generated
2026-07-18
AI Q&A
2026-07-18
EPSS Evaluated
N/A
NVD
CVE-2025-71390
EUVD
EUVD-2025-210490

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
surrealdb surrealdb to 2.1.8 (exc)
surrealdb surrealdb to 2.2.6 (exc)
surrealdb surrealdb to 2.3.6 (exc)
surrealdb surrealdb to 3.0.0-alpha.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects SurrealDB versions before 2.3.6, 2.2.6, 2.1.8, and 3.0.0-alpha.7. It allows authenticated users to bypass network access restrictions by providing a URL with a hostname that resolves to a denied IP address in http::* functions. The server then issues the request and returns a response, potentially exposing sensitive information or internal endpoints.

Detection Guidance

To detect this vulnerability, check SurrealDB server versions. Run: surrealdb version. If the version is below 2.1.8, 2.2.6, 2.3.6, or 3.0.0-alpha.7, the system is vulnerable. Additionally, monitor network logs for http::* function calls with hostnames resolving to denied IPs.

Impact Analysis

An attacker could exploit this to access restricted internal endpoints, retrieve sensitive data, or alter information depending on the deployment. It bypasses network controls, potentially leading to data breaches or unauthorized system interactions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Non-compliance may result in legal penalties, data breach notifications, and reputational damage due to exposed personal or health information.

Mitigation Strategies

Immediately upgrade SurrealDB to patched versions (2.1.8, 2.2.6, 2.3.6, or later). If upgrading is not possible, disable network capabilities or implement an allowlist for network access. Restrict authenticated user permissions to limit http::* function usage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-71390. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart