# CVE-2026-121422: SurrealDB server-side request forgery in JWKS URL validation

Source: https://junglewise.ai/threats/cve-2026-121422-surrealdb-from-3-1-0-before-3-3-0-contains-a-server-side-request  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-121422 · Severity: medium · CVSS 4.1 · Published 2026-11-03

SurrealDB is a database platform that allows administrators to configure authentication methods using JSON Web Key Sets (JWKS) URLs. A vulnerability allows database owners to bypass network access controls by omitting the port number from JWKS URLs, enabling the server to send requests to internal services that should be blocked. This could lead to unauthorized access to or information disclosure from internal network services.

Technologies: [Surrealdb](https://junglewise.ai/threats/technologies/surrealdb-surrealdb). Vendors: [SurrealDB](https://junglewise.ai/threats/vendors/surrealdb).

## Quick answers

**Is CVE-2026-121422 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121422 being exploited in the wild.

**How severe is CVE-2026-121422?** Medium severity, with a CVSS score of 4.1, published 3 November 2026.

**Which products and versions are affected?** Surrealdb 3.1.0 to 3.2.x.

**Is there a fix for CVE-2026-121422?** Yes: fixed in 3.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121422 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-121422?** Check whether you run Surrealdb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.3.0

## Technical details

A server-side request forgery (SSRF) vulnerability exists in SurrealDB's JWKS preflight policy and redirect handling. When a JWKS URL uses implicit default ports (80 for HTTP or 443 for HTTPS), the port is not included in the network policy check, allowing requests to bypass port-specific deny-net rules. An authenticated database owner can configure a JWT or record access method with a JWKS URL targeting a denied internal service on a default port, causing SurrealDB to send unfiltered GET requests to explicitly blocked destinations. The fix is to use port_or_known_default() instead of port() when constructing the network target for policy evaluation.

## Affected products

- SurrealDB SurrealDB 3.1.0 to 3.2.x

## Timeline

- 2026-10-19: disclosed: GitHub Security Advisory GHSA-h3mp-7wcg-p6vj published
- 2026-11-03: advisory

## References

- [https://github.com/surrealdb/surrealdb/security/advisories/GHSA-h3mp-7wcg-p6vj](https://github.com/surrealdb/surrealdb/security/advisories/GHSA-h3mp-7wcg-p6vj)
- [https://www.vulncheck.com/advisories/surrealdb-from-3.1.0-before-3.3.0-ssrf-via-jwks-implicit-default-port-bypass](https://www.vulncheck.com/advisories/surrealdb-from-3.1.0-before-3.3.0-ssrf-via-jwks-implicit-default-port-bypass)

## Related threats

- [SurrealDB unbounded recursion in value serialization](https://junglewise.ai/threats/cve-2026-121423-surrealdb-before-3-3-0-contains-an-unbounded-recursion)
- [SurrealDB server-side request forgery in network deny rules](https://junglewise.ai/threats/cve-2026-121421-surrealdb-3-1-0-before-3-3-0-contains-a-server-side-request)
- [SurrealDB MCP session hijack via BoundSubject fingerprint collision](https://junglewise.ai/threats/cve-2026-121419-surrealdb-from-3-1-0-before-3-3-0-contains-an-improper)
- [SurrealDB authorization bypass via streaming index planner](https://junglewise.ai/threats/cve-2026-121418-surrealdb-from-3-1-0-before-3-3-0-contains-an-incorrect)
- [SurrealDB deny-funcs capability bypass via method-style invocations](https://junglewise.ai/threats/cve-2026-121416-surrealdb-2-0-0-before-3-3-1-does-not-enforce-deny-funcs)