Live › vulnerability › CVE-2026-121421
SurrealDB 3.1.0 before 3.3.0 has port-specific --deny-net rules that only match literal host strings, and the resolved-IP check ignores the port. An authenticated user calling http::* functions can reach internal services that the deny rules were meant to block.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Teams running SurrealDB 3.1.0 through 3.2.x that rely on port-specific --deny-net rules to restrict outbound network access from the server. Exposure requires an authenticated user who can call http::* functions. Deployments without --deny-net rules, or using only host-level rules, are not described as affected.
No product ranges from the sources yet.
surreal version; affected builds are 3.1.0 up to but not including 3.3.0.--deny-net rules that use HOST:PORT or IP:PORT forms.3.3.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SurrealDB 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability in network-capability matching because port-specific --deny-net rules (HOST:PORT or IP:PORT) match only a literal host string, while the resolved-IP check discards the port. Authenticated users can call http::* functions with a hostname resolving to a denied IP, or the IP of a denied hostname, to reach blocked internal services.
This page as .md · .json · in your agent: get_signal("CVE-2026-121421")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.