CVE-2026-121421
MEDIUM
MEDIUM
Priority: 0.02
BB Relevance:
61/100
Published: 2026-11-03
Modified: 2026-11-03
First seen: 2026-11-03
Status: active
Attack Surface
Network
Low Complexity
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
None
AT:
None
VC:
None
VI:
Low
VA:
None
Description
SurrealDB 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability in network-capability matching because port-specific --deny-net rules (HOST:PORT or IP:PORT) match only a literal host string, while the resolved-IP check discards the port. Authenticated users can call http::* functions with a hostname resolving to a denied IP, or the IP of a denied hostname, to reach blocked internal services.
Weakness Classification (1)
Affected Software (2)
References & Advisories (3)
vendor-advisory
third-party-advisory
patch