CVE-2026-63736 Details
Description
SurrealDB before 3.2.0 contains a server-side request forgery vulnerability in the JWKS fetcher that validates only the URL hostname string against allow-lists without checking resolved IP addresses. An Owner role attacker can point an access method at an allow-listed hostname resolving to private or loopback addresses, causing the server to issue GET requests to internal addresses that would be blocked by direct URL.
A server-side request forgery (SSRF) vulnerability has been identified in SurrealDB versions prior to 3.2.0. The issue arises in the JWKS fetcher, which only validates the URL hostname against allow-lists without checking the resolved IP addresses. This flaw allows an attacker with Owner role privileges to direct an access method at an allow-listed hostname that resolves to private or loopback addresses. Consequently, the server may issue GET requests to internal addresses that would typically be blocked by direct URL access.
Users can upgrade to SurrealDB version 3.2.0 or later, where this vulnerability has been patched. Alternatively, restrict the Owner role to trusted operators and enforce network-layer egress filtering to block access to loopback, link-local, cloud-metadata, and private address ranges.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/surrealdb/surrealdb/security/advisories/GHSA-5x4x-2946-qr67 | [email protected] | Vendor AdvisoryMitigation |
| https://www.vulncheck.com/advisories/surrealdb-before-ssrf-via-jwks-url-hostname-resolution | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| surrealdb surrealdb | < 3.2.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | Initial Analysis | [email protected] |
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | New CVE Received | [email protected] |