CVE-2026-63736: SurrealDB before 3.2.0 SSRF via JWKS URL hostname resolution
SurrealDB before 3.2.0 contains a server-side request forgery vulnerability in the JWKS fetcher that validates only the URL hostname string against allow-lists without checking resolved IP addresses. An Owner role attacker can point an access method at an allow-listed hostname resolving to private or loopback addresses, causing the server to issue GET requests to internal addresses that would be blocked by direct URL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SurrealDBto a version that resolves this vulnerability.Fixed in 3.2.0 - Compensating control
Apply compensating controls to restrict SurrealDB server-side outbound requests (e.g., network egress allow-lists/deny private or loopback destinations) to prevent SSRF to internal addresses via the JWKS URL hostname resolution.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63736?
CVE-2026-63736 has a medium severity score of 5.1.
How do I fix CVE-2026-63736?
To mitigate CVE-2026-63736, update SurrealDB to version 3.2.0 or later.
What is the nature of the vulnerability described in CVE-2026-63736?
CVE-2026-63736 is a server-side request forgery (SSRF) vulnerability affecting the JWKS URL hostname resolution.
Who can exploit CVE-2026-63736?
An attacker with an Owner role can exploit CVE-2026-63736.
What are the potential impacts of the CVE-2026-63736 vulnerability?
Exploitation of CVE-2026-63736 may allow access to private services by resolving allow-listed hostnames.