---
id: "CVE-2026-121420"
kind: "vulnerability"
aliases: ["CVE-2026-121420"]
title: "SurrealDB: SSRF via IPv6 transition addresses reaches internal hosts"
severity: "medium"
cvss: 4.8
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "cloud", "self-hosted", "surrealdb"]
not_affected_if: ["default-config"]
published_at: "2026-11-03T15:17:32+00:00"
first_seen_at: "2026-11-03T15:21:59+00:00"
updated_at: "2026-11-03T15:24:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121420", "first_seen_at": "2026-11-03T15:21:59+00:00"}]
---

# SurrealDB: SSRF via IPv6 transition addresses reaches internal hosts

SurrealDB 3.2.0 before 3.3.0 fails to detect private IPv4 addresses wrapped in NAT64, 6to4, and Teredo IPv6 addresses when filtering outbound requests. An authenticated user can use SurrealQL HTTP functions to reach localhost, internal services, or cloud metadata endpoints.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed SurrealDB version with `surreal version`, and treat `3.2.0` up to but not including `3.3.0` as exposed.
- Review whether any user can call SurrealQL HTTP functions such as `http::get` in your deployment.

## Fix

- SurrealDB: move to `3.3.0` or later

## Timeline

- 2026-11-03T15:21:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121420

## Documents

- [advisory] Vendor advisory: github.com https://github.com/surrealdb/surrealdb/security/advisories/GHSA-c9wc-jcr5-8974
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/surrealdb-3.2.0-before-3.3.0-ssrf-guard-bypass-via-ipv6-transition-addresses

## From the sources

SurrealDB from 3.2.0 before 3.3.0 contains a server-side request forgery vulnerability in the FilteringResolver is_private_ip check that fails to unwrap NAT64, 6to4, and Teredo IPv6 addresses. Authenticated users triggering outbound HTTP requests via SurrealQL http functions can use transition addresses embedding private IPv4 targets to reach localhost, internal services, or cloud metadata endpoints.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_