CVE-2026-121421: SurrealDB 3.1.0 before 3.3.0 SSRF via Port-Specific --deny-net Host Aliasing Bypass
SurrealDB 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability in network-capability matching because port-specific --deny-net rules (HOST:PORT or IP:PORT) match only a literal host string, while the resolved-IP check discards the port. Authenticated users can call http:: functions with a hostname resolving to a denied IP, or the IP of a denied hostname, to reach blocked internal services.
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
SurrealDB versions 3.1.0 through versions before 3.3.0 are affected when network access controls use port-specific --deny-net entries in HOST:PORT or IP:PORT form. The issue concerns requests made through http::* functions.
What does an attacker need to exploit it?
An attacker needs authenticated access and the ability to invoke http::* functions. They can use a hostname that resolves to a denied IP address, or an IP address corresponding to a denied hostname, to reach an internal service blocked by a port-specific rule.
Are non-port-specific --deny-net rules affected?
The provided information identifies the bypass specifically in port-specific HOST:PORT or IP:PORT rules. It does not state that host-only or IP-only --deny-net rules are affected.
What is the available remediation?
Upgrade to SurrealDB 3.3.0 or later. The affected range is 3.1.0 before 3.3.0.