{"id":"CVE-2026-121420","kind":"vulnerability","aliases":["CVE-2026-121420"],"related":[],"title":"SurrealDB: SSRF via IPv6 transition addresses reaches internal hosts","description":"SurrealDB from 3.2.0 before 3.3.0 contains a server-side request forgery vulnerability in the FilteringResolver is_private_ip check that fails to unwrap NAT64, 6to4, and Teredo IPv6 addresses. Authenticated users triggering outbound HTTP requests via SurrealQL http functions can use transition addresses embedding private IPv4 targets to reach localhost, internal services, or cloud metadata endpoints.","summary":"SurrealDB 3.2.0 before 3.3.0 fails to detect private IPv4 addresses wrapped in NAT64, 6to4, and Teredo IPv6 addresses when filtering outbound requests. An authenticated user can use SurrealQL HTTP functions to reach localhost, internal services, or cloud metadata endpoints.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","cloud","self-hosted","surrealdb"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed SurrealDB version with `surreal version`, and treat `3.2.0` up to but not including `3.3.0` as exposed.\n- Review whether any user can call SurrealQL HTTP functions such as `http::get` in your deployment.","fix":"- SurrealDB: move to `3.3.0` or later","status":"open","published_at":"2026-11-03T15:17:32+00:00","first_seen_at":"2026-11-03T15:21:59+00:00","triaged_at":"2026-11-03T15:24:46+00:00","updated_at":"2026-11-03T15:24:46+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-11-03T15:24:46Z","model":"claude-haiku-5-5","output":{"fix":"- SurrealDB: move to `3.3.0` or later","reach":"network","title":"SurrealDB: SSRF via IPv6 transition addresses reaches internal hosts","impact":"medium","summary":"SurrealDB 3.2.0 before 3.3.0 fails to detect private IPv4 addresses wrapped in NAT64, 6to4, and Teredo IPv6 addresses when filtering outbound requests. An authenticated user can use SurrealQL HTTP functions to reach localhost, internal services, or cloud metadata endpoints.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["surrealdb","self-hosted","cloud"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reaches internal services and cloud metadata endpoints through the server","analyst_note":"","how_to_check":"- Check the installed SurrealDB version with `surreal version`, and treat `3.2.0` up to but not including `3.3.0` as exposed.\n- Review whether any user can call SurrealQL HTTP functions such as `http::get` in your deployment.\n- unknown","plain_action":"","needs_analyst":false,"not_affected_if":["default-config"],"who_is_affected":"Deployments of SurrealDB 3.2.x where authenticated users can run SurrealQL HTTP functions that make outbound requests. The risk is greatest where the server can reach internal networks or cloud metadata endpoints. Instances that do not allow user-supplied HTTP calls, or that restrict egress, are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000719,"input_tokens":4228,"output_tokens":593,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121420':12A,15A '-2026':11A,14A '3.2.0':25B,65C '3.3.0':27B,67C '6to4':37B,88C 'address':6A,33B,41B,92C,106C 'ai':17B 'ai-tool':16B 'authent':47B,93C 'check':82C 'cloud':19B,60B,117C 'contain':68C 'cve':10A,13A 'detect':30B 'embed':107C 'endpoint':62B,119C 'fail':28B,84C 'filter':43B 'filteringresolv':78C 'forgeri':74C 'function':53B,102C 'host':9A,22B 'http':52B,97C,101C 'intern':8A,57B,114C 'ip':81C 'ipv4':32B,109C 'ipv6':4A,40B,91C 'localhost':56B,113C 'metadata':61B,118C 'nat64':36B,87C 'outbound':44B,96C 'privat':31B,80C,108C 'reach':7A,55B,112C 'request':45B,73C,98C 'self':21B 'self-host':20B 'server':71C 'server-sid':70C 'servic':58B,115C 'side':72C 'ssrf':2A 'surrealdb':1A,23B,24B,63C 'surrealql':51B,100C 'target':110C 'teredo':39B,90C 'tool':18B 'transit':5A,105C 'trigger':95C 'unwrap':86C 'use':50B,104C 'user':48B,94C 'via':3A,99C 'vulner':75C 'wrap':34B","nicknames":[],"mitigations":[],"who_affected":"Deployments of SurrealDB 3.2.x where authenticated users can run SurrealQL HTTP functions that make outbound requests. The risk is greatest where the server can reach internal networks or cloud metadata endpoints. Instances that do not allow user-supplied HTTP calls, or that restrict egress, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","cloud","medium","selfhosted","surrealdb"],"first_public_at":"2026-10-19T08:51:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121420","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121420","severity":null,"published_at":"2026-11-03T15:17:32+00:00","modified_at":"2026-11-03T15:17:32+00:00","first_seen_at":"2026-11-03T15:21:59+00:00","fetched_at":"2026-11-03T15:21:59+00:00","note":null}],"documents":[{"id":58364,"url":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-c9wc-jcr5-8974","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-19T08:51:38+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":58365,"url":"https://www.vulncheck.com/advisories/surrealdb-3.2.0-before-3.3.0-ssrf-guard-bypass-via-ipv6-transition-addresses","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}