EUVD-2025-210490
GHSA-vp9r-94xg-q7q8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Scope changes to subsequent internal systems (S:C); PR:L for authenticated requirement; A:N because availability on downstream services is not the primary impact pathway.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames against --deny-net network access restrictions in its http::* functions. An authenticated user can invoke http::<fn>(<url>) with a hostname that resolves to a denied IP address, causing the server to issue the request anyway and return the response. This bypasses network access controls, allowing access to restricted internal endpoints and potentially retrieving or altering sensitive information and credentials, depending on the deployment.
AnalysisAI
DNS rebinding SSRF bypass in SurrealDB's http::* query functions allows authenticated low-privileged users to reach internal network endpoints that administrators explicitly blocked via the --deny-net flag. The server validates the user-supplied hostname string against the deny list rather than the resolved IP address, so a hostname that resolves to a blocked internal IP passes the check and the outbound request is issued anyway. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, but the CVSS 4.0 subsequent-system impact is rated High across all three CIA components, reflecting that internal services reached via this SSRF bypass may be completely unauthenticated and expose credentials, metadata, or allow configuration changes.
Technical ContextAI
SurrealDB is a multi-model database whose SurrealQL query language includes built-in HTTP client functions (http::get, http::post, http::put, http::patch, http::delete, http::head) for making outbound web requests directly from queries. The --deny-net startup flag is the mechanism administrators use to restrict which network ranges or hosts these functions may contact - a critical control in shared or multi-tenant deployments to prevent queries from reaching internal infrastructure. The flaw is a classic DNS SSRF: the authorization check (CWE-863, Incorrect Authorization) is performed against the hostname label rather than the IP address it resolves to at runtime. An attacker who controls a public DNS record, or leverages a public DNS rebinding service, can supply a hostname that passes the --deny-net string comparison but whose A record points to a denied internal IP (e.g., 169.254.169.254 for cloud metadata, 10.x.x.x for internal services). The affected CPE is cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*, spanning all branches prior to the patched releases.
RemediationAI
Upgrade to one of the patched releases corresponding to the branch in use: SurrealDB 2.1.8, 2.2.6, or 2.3.6 (stable branches), or a 3.0.0 alpha release newer than 3.0.0-alpha.7. The vendor advisory at https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m3c3-78fh-w3w7 is the authoritative reference for patch availability. If an immediate upgrade is not feasible, a targeted compensating control is to disable or restrict access to the http::* function family at the SurrealDB permission level, preventing authenticated users from invoking outbound HTTP functions entirely - this eliminates the attack surface but also removes the http::* capability for legitimate queries. A secondary control for cloud deployments is to enforce IMDSv2 (token-required) on EC2 instances, which blocks unauthenticated access to the metadata endpoint even if SSRF reaches it, reducing the credential-theft impact; note this does not prevent SSRF against other internal services. Network-layer egress filtering at the host or container level to block SurrealDB process outbound connections to internal ranges provides defense-in-depth but duplicates the intent of --deny-net and should not be treated as sufficient alone given that bypass is the core issue.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted
Denial of service in SurrealDB before 2.2.2 lets an authenticated user crash the database by calling the string::replace
Memory exhaustion in SurrealDB's scripting subsystem allows authenticated users to bypass the server's recursion depth l
Server-side request forgery in SurrealDB before versions 2.0.5, 2.1.5, and 2.2.2 allows authenticated users to circumven
SurrealDB versions 3.0.0 through 3.1.4 expose a query-planner authorization bypass that allows authenticated record user
Local file read via DEFINE ANALYZER in SurrealDB before versions 2.1.5 and 2.2.2 allows authenticated users holding root
Resource exhaustion in SurrealDB's embedded JavaScript scripting feature allows authenticated users to deny service by s
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today