Is CVE-2026-121422 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121422 being exploited in the wild.

How severe is CVE-2026-121422?

Medium severity, with a CVSS score of 4.1, published 3 November 2026.

Is there a fix for CVE-2026-121422?

Yes: fixed in 3.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-121422 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-121422?

Check whether you run Surrealdb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121422: SurrealDB server-side request forgery in JWKS URL validation

CVE-2026-121422 · Severity: medium · CVSS 4.1 · Published 2026-11-03

SurrealDB is a database platform that allows administrators to configure authentication methods using JSON Web Key Sets (JWKS) URLs. A vulnerability allows database owners to bypass network access controls by omitting the port number from JWKS URLs, enabling the server to send requests to internal services that should be blocked. This could lead to unauthorized access to or information disclosure from internal network services.

Technologies: Surrealdb. Vendors: SurrealDB.

Quick answers

Is CVE-2026-121422 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121422 being exploited in the wild.
How severe is CVE-2026-121422?: Medium severity, with a CVSS score of 4.1, published 3 November 2026.
Which products and versions are affected?: Surrealdb 3.1.0 to 3.2.x.
Is there a fix for CVE-2026-121422?: Yes: fixed in 3.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121422 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-121422?: Check whether you run Surrealdb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.3.0

Technical details

A server-side request forgery (SSRF) vulnerability exists in SurrealDB's JWKS preflight policy and redirect handling. When a JWKS URL uses implicit default ports (80 for HTTP or 443 for HTTPS), the port is not included in the network policy check, allowing requests to bypass port-specific deny-net rules. An authenticated database owner can configure a JWT or record access method with a JWKS URL targeting a denied internal service on a default port, causing SurrealDB to send unfiltered GET requests to explicitly blocked destinations. The fix is to use port_or_known_default() instead of port() when constructing the network target for policy evaluation.

Affected products

SurrealDB SurrealDB 3.1.0 to 3.2.x

Timeline

2026-10-19: disclosed: GitHub Security Advisory GHSA-h3mp-7wcg-p6vj published
2026-11-03: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.