CVE-2026-121420: SurrealDB 3.2.0 before 3.3.0 SSRF Guard Bypass via IPv6 Transition Addresses

Published Nov 3, 2026

Updated

SurrealDB from 3.2.0 before 3.3.0 contains a server-side request forgery vulnerability in the FilteringResolver isprivateip check that fails to unwrap NAT64, 6to4, and Teredo IPv6 addresses. Authenticated users triggering outbound HTTP requests via SurrealQL http functions can use transition addresses embedding private IPv4 targets to reach localhost, internal services, or cloud metadata endpoints.

Event History

Nov 3, 2026

CVE Published

via MITRE·02:28 PM

Data Sourced

via MITRE·02:28 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated SurrealDB user who can trigger outbound HTTP requests through SurrealQL http functions can exploit it. The affected request target must be reachable through an IPv6 transition address that embeds a private IPv4 address.

Which internal targets may be reachable?

The issue can be used to reach localhost, internal services, or cloud metadata endpoints when their private IPv4 addresses are embedded in NAT64, 6to4, or Teredo IPv6 transition addresses.

Are all SurrealDB versions affected?

The affected range is SurrealDB 3.2.0 up to, but not including, 3.3.0. Version 3.3.0 is outside the stated affected range.

CVE-2026-121420: SurrealDB 3.2.0 before 3.3.0 SSRF Guard Bypass via IPv6 Transition Addresses

Event History

Frequently Asked Questions

Who can exploit this issue?

Which internal targets may be reachable?

Are all SurrealDB versions affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which internal targets may be reachable?

Are all SurrealDB versions affected?