CVE-2026-63743 Details
Description
SurrealDB before 3.1.0 contains a capability bypass vulnerability in HTTP redirect handling that allows authenticated users to circumvent port-scoped --deny-net rules. Attackers can chain an HTTP redirect from an allowed hostname to a denied host:port combination, and the redirect is followed because the port information is dropped during redirect policy evaluation.
A capability bypass vulnerability has been identified in SurrealDB versions prior to 3.1.0, specifically in the handling of HTTP redirects. This vulnerability allows authenticated users to bypass port-scoped deny-net rules. The issue arises because the port information is omitted during the evaluation of redirect policies, enabling users to chain an HTTP redirect from an allowed hostname to a denied host:port combination. As a result, the redirect is followed, circumventing the intended network restrictions.
Users can upgrade to SurrealDB version 3.1.0 or later, where this vulnerability has been patched. For those unable to upgrade, consider replacing port-specific deny rules with host-only deny rules where feasible, disabling HTTP functions for untrusted principals, or terminating outbound HTTP requests at a reverse proxy that enforces port-specific access controls.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/surrealdb/surrealdb/security/advisories/GHSA-97vg-427p-8hx5 | [email protected] | Vendor AdvisoryMitigation |
| https://www.vulncheck.com/advisories/surrealdb-before-port-specific-deny-rule-bypass-via-http-redirect | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| surrealdb surrealdb | < 3.1.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | Initial Analysis | [email protected] |
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | New CVE Received | [email protected] |