Executive brief
SurrealDB is a database platform that includes HTTP functions for accessing external network endpoints. Administrators typically configure it to block access to sensitive internal networks using the `--deny-net` flag (e.g., to block private IP ranges). However, an authenticated attacker can bypass this restriction by leveraging DNS hostname resolution—making HTTP requests to hostnames that resolve to blocked IP addresses, effectively circumventing the security policy and potentially accessing internal services and sensitive data.
Technical details
SurrealDB's network access control mechanism uses the `--deny-net` and `--allow-net` flags to restrict outbound HTTP requests from `http::*` functions. This vulnerability exists in the improper restriction of communications to intended endpoints (CWE-923). An authenticated user can invoke `http::*` functions with hostnames that resolve via DNS to IP addresses within the denied network ranges, and the SurrealDB server will still issue the request and return responses to the attacker. The vulnerability requires authentication and occurs at HTTP request time when hostname resolution happens after the initial security check. Patches have been released in versions 2.1.8, 2.2.6, 2.3.6, and 3.0.0-alpha.7 and later, which implement hostname resolution validation against allowed network targets.
Affected products
- SurrealDB SurrealDB 2.1.0–2.1.7, 2.2.0–2.2.5, 2.3.0–2.3.5, 3.0.0-alpha.1–3.0.0-alpha.6
Timeline
- 2025-06-26: disclosed
- 2026-09-04: advisory