EUVD-2026-45914
GHSA-vq7c-3hc9-m5hr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated network exploitation with low complexity; scope changes because redirect bypass reaches subsequent internal systems; no availability impact from the bypass itself.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
3DescriptionCVE.org
SurrealDB before 3.1.0 contains a capability bypass vulnerability in HTTP redirect handling that allows authenticated users to circumvent port-scoped --deny-net rules. Attackers can chain an HTTP redirect from an allowed hostname to a denied host:port combination, and the redirect is followed because the port information is dropped during redirect policy evaluation.
AnalysisAI
Server-Side Request Forgery via HTTP redirect in SurrealDB before 3.1.0 allows authenticated users to circumvent port-scoped --deny-net network restriction rules. When an http::* function call targets an allowed hostname that responds with a 3xx redirect to a denied host:port, the redirect policy in core/src/fnc/util/http/mod.rs constructs the redirect NetTarget from url.host_str() alone - silently discarding the port - causing the capability matcher to skip port-specific deny rules entirely. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
SurrealDB exposes a family of http::* built-in query functions that allow database principals to initiate outbound HTTP requests. Operators constrain reachable network targets using --allow-net and --deny-net capability flags, which can be scoped to a bare host or to a specific host:port combination. The root cause is CWE-918 (Server-Side Request Forgery): on receiving a 3xx redirect response, the redirect policy in surrealdb/core/src/fnc/util/http/mod.rs builds a NetTarget solely from url.host_str(), discarding url.port(). The capability matcher in surrealdb/core/src/dbs/capabilities.rs (lines 259-264) contains a match arm Self::Host(host, Some(port)) => match tgt { _ => false } that unconditionally returns false when the evaluated target carries no port, meaning any deny rule expressed as --deny-net host:port silently fails to fire against redirect destinations. Host-only deny rules (--deny-net host) are unaffected because their matcher arm accepts port-stripped targets.
RemediationAI
Upgrade to SurrealDB 3.1.0 or later, which patches the redirect policy in core/src/fnc/util/http/mod.rs to include url.port() when constructing the NetTarget for redirect destinations, ensuring port-specific deny rules apply identically to initial requests and redirects. The fix is documented in the GitHub Security Advisory GHSA-97vg-427p-8hx5 and is traceable to commit ceb1ca3a1 in the SurrealDB repository. For deployments where an immediate upgrade is not feasible, the official workaround is to replace all port-specific deny rules (--deny-net host:port) with host-only rules (--deny-net host); note that this broadens the denial scope to all ports on the affected host, which may inadvertently block legitimate traffic on other ports and requires careful review of existing allow-net rules. A secondary compensating control is to restrict http::* invocation privileges to the minimum set of fully trusted principals, reducing the attacker pool without changing network policy.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-act
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single Web
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process wi
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belon
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role discl
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today