EUVD-2026-45907
GHSA-qrjc-jcj4-56p7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Owner-role requirement drives PR:H; scope change because SSRF reaches internal systems outside SurrealDB's security boundary; GET-only impact limits confidentiality to L with no integrity or availability effect.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
SurrealDB before 3.2.0 contains a server-side request forgery vulnerability in the JWKS fetcher that validates only the URL hostname string against allow-lists without checking resolved IP addresses. An Owner role attacker can point an access method at an allow-listed hostname resolving to private or loopback addresses, causing the server to issue GET requests to internal addresses that would be blocked by direct URL.
AnalysisAI
Server-Side Request Forgery in SurrealDB's JWKS fetcher allows an Owner-role attacker to weaponize the server as an internal network proxy. By configuring an access method with a JWKS URL whose hostname passes the string-based allow-list check but resolves via DNS to a private or loopback address, the attacker causes SurrealDB to issue GET requests to internal infrastructure that would otherwise be unreachable. No public exploit has been identified and no CISA KEV listing exists; exploitation is constrained by the requirement for Owner-level privileges, making this a meaningful but bounded risk in privileged-access-compromise scenarios.
Technical ContextAI
SurrealDB uses JWKS (JSON Web Key Set) endpoints to retrieve public keys for validating access method tokens - a standard pattern in OAuth/OIDC-adjacent authentication flows. The root cause is CWE-918 (Server-Side Request Forgery): the JWKS fetcher validates the URL's hostname component as a string against a configured allow-list but does not resolve the hostname to an IP address and verify that the resolved address is a public, routable IP. This is a classic DNS-rebinding-adjacent pattern - an attacker who controls DNS for an allow-listed hostname (or can register a hostname that was added to the allow-list) can serve responses that map the domain to RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or loopback (127.0.0.0/8). The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:H confirms the attack is network-reachable with no special attack requirements but mandates High privileges. No CPE strings were provided in the input data.
RemediationAI
Upgrade SurrealDB to version 3.2.0 or later, which resolves the vulnerability by validating the resolved IP address against a blocklist of private and loopback ranges in addition to the hostname string check. The vendor advisory at https://github.com/surrealdb/surrealdb/security/advisories/GHSA-5x4x-2946-qr67 should be consulted for release notes. As a compensating control prior to patching, implement network-level egress filtering on the SurrealDB server host to block outbound connections to RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and loopback (127.0.0.0/8); note this may disrupt any legitimately configured internal JWKS endpoints. Additionally, audit all configured access method JWKS URLs to confirm they resolve only to public IP space, and restrict Owner-role assignment to the minimum necessary principals to reduce the likelihood of this path being reachable at all.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-act
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single Web
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process wi
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belon
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role discl
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today