SurrealDB CVE-2026-121422

Requires an authenticated attacker with database Owner privileges (CVSS PR:H) on SurrealDB 3.1.0 through before 3.3.0. The attacker must be able to configure a JWT or record access method and set its JWKS URL to a target that uses an implicit HTTP/HTTPS default port (port 80 or 443 omitted from the URL). Exploitation is only meaningful where the process operator has defined port-specific deny-net rules such as deny-net 127.0.0.1:80 or deny-net internal.example:443 - the bug is that these specific-port rules fail to match when the port is implicit. Limiting factors: the response is blind (parsed only as JWKS, no body returned to the attacker), only reachability/timing/parse-success inference is possible, no confidentiality disclosure beyond that, no integrity or availability impact, and rules that use non-default explicit ports (e.g. :8080) are unaffected and still enforced.

This is a genuine but bounded issue, best characterized as a medium-severity, authenticated SSRF rather than an urgent emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N, base 5.1) shows the key gating factor is PR:H: exploitation requires an attacker who already holds database Owner privileges, so this is a privilege-boundary / network-policy-bypass flaw, not a pre-auth internet-facing one. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with the moderate score. No EPSS score, no CISA KEV listing, and no SSVC automatable/technical-impact fields were provided in the input, so exploitation-probability and automation signals are UNKNOWN rather than low - they are simply absent and should not be read as reassurance. Impact is deliberately constrained: the vendor states the response is blind and parsed only as JWKS, yielding internal host/service reachability, timing, and JWKS-parse-success inference (hence VC:L and the scope/subsequent-system signal SC:L), not data theft or code execution. There is no conflict between the vector and the description; both agree on authenticated, network-triggered, blind, low-impact SSRF. Net: a legitimate defense-in-depth bypass worth patching on a normal cycle, elevated mainly where the Owner role is shared, delegated, or multi-tenant.

A user holding database Owner rights in a shared or multi-tenant SurrealDB instance (3.1.0 up to before 3.3.0) defines a JWT or record access method whose JWKS URL points at an internal service using an implicit default port - e.g. http://127.0.0.1/jwks.json - that the operator explicitly blocked with a rule like deny-net 127.0.0.1:80. Because the port check drops the implicit default port, SurrealDB issues a server-side GET to the denied endpoint, letting the Owner probe internal reachability, timing, and JWKS-parse success across the network-policy boundary. The GHSA advisory includes a reproduction/canary test demonstrating the bypass; it is a proof-of-concept reference, not verified as weaponized exploit code.