CVE-2026-63743
Received Received - Intake

SurrealDB HTTP Redirect Capability Bypass

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: VulnCheck

Description
SurrealDB before 3.1.0 contains a capability bypass vulnerability in HTTP redirect handling that allows authenticated users to circumvent port-scoped --deny-net rules. Attackers can chain an HTTP redirect from an allowed hostname to a denied host:port combination, and the redirect is followed because the port information is dropped during redirect policy evaluation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-63743
EUVD
EUVD-2026-45914

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
surrealdb surrealdb to 3.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SurrealDB before version 3.1.0 has a vulnerability where authenticated users can bypass port-scoped network access restrictions by exploiting HTTP redirects. When a request is redirected from an allowed host to a denied host:port, the port information is lost during evaluation, allowing access to restricted services.

Detection Guidance

To detect this vulnerability, check if your SurrealDB version is below 3.1.0. Run: surrealdb version. If the version is older, the system is vulnerable. Additionally, monitor HTTP redirect behavior in logs for unexpected redirections from allowed to denied hosts.

Impact Analysis

This vulnerability allows attackers with authenticated access to bypass network restrictions and access internal services like Redis or cloud metadata services that should be blocked by port-scoped deny rules. It could lead to unauthorized data access or service manipulation.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access to restricted internal services through port-scoped --deny-net rule bypasses. Attackers might exploit HTTP redirects to access sensitive data or systems, violating data protection and confidentiality requirements.

Mitigation Strategies

Upgrade SurrealDB to version 3.1.0 or later. If upgrading is not possible, disable http::* functions, use host-only deny rules, or enforce port controls via a reverse proxy. Avoid using port-scoped --deny-net rules until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63743. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart