CVE-2026-121421 Details
Description
SurrealDB 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability in network-capability matching because port-specific --deny-net rules (HOST:PORT or IP:PORT) match only a literal host string, while the resolved-IP check discards the port. Authenticated users can call http::* functions with a hostname resolving to a denied IP, or the IP of a denied hostname, to reach blocked internal services.
A server-side request forgery (SSRF) vulnerability has been identified in SurrealDB versions 3.1.0 prior to 3.3.0. The issue arises in network-capability matching, where port-specific deny-net rules (HOST:PORT or IP:PORT) are only enforced against literal host strings. The resolved-IP check, which is supposed to validate these rules, discards the port information, creating a loophole. Authenticated users can exploit this by using a hostname that resolves to a denied IP, or vice versa, to access blocked internal services.
Users can upgrade to SurrealDB version 3.3.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/surrealdb/surrealdb/security/advisories/GHSA-mhv5-88p6-w4c3 | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/surrealdb/surrealdb/commit/9d9a5b0693e499e0d030cac6b618062ec02cd2bc | [email protected] | Source CodeVendor |
| https://github.com/surrealdb/surrealdb/security/advisories/GHSA-mhv5-88p6-w4c3 | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/surrealdb-3.1.0-before-3.3.0-ssrf-via-port-specific-deny-net-host-aliasing-bypass | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SurrealDB | >= 3.1.0, < 3.3.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | [email protected] |