Live › vulnerability › CVE-2026-121422
SurrealDB versions from 3.1.0 before 3.3.0 let a database Owner set a JWKS URL without an explicit port, which skips port-specific deny-net rules. The server then sends blind GET requests to internal services that were meant to be blocked.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Teams running self-hosted SurrealDB 3.1.x or 3.2.x that use JWT or record access methods with JWKS URLs and rely on deny-net rules to block internal services. Exposure requires a database Owner role, so deployments where only trusted administrators hold Owner can rate it lower. Managed hosting is not covered by these sources.
No product ranges from the sources yet.
surreal version; versions from 3.1.0 up to but not including 3.3.0 are in range.3.3.0 or later, per the sources' stated fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SurrealDB from 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability that allows database Owners to bypass port-specific deny-net rules by using JWKS URLs with implicit default ports. Attackers can configure a JWT or record access method whose JWKS URL omits port 80 or 443, causing blind GET requests to explicitly denied internal services.
This page as .md · .json · in your agent: get_signal("CVE-2026-121422")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.