Executive brief
SurrealDB is a multi-model database used for managing and storing application data. A security flaw in how the database fetches security keys (JWKS) allows an administrative user to bypass network restrictions. By using a specially crafted web address, an attacker with high-level permissions can force the database server to send requests to internal systems or private services that should normally be inaccessible, potentially revealing information about the internal network environment.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in SurrealDB's JWKS fetcher within `core/src/iam/jwks.rs`. The `check_capabilities_url` function validates only the provided hostname string against allow-lists but fails to verify the actual IP address after DNS resolution. An attacker with 'Owner' privileges can configure an access method pointing to a permitted hostname that resolves to a loopback, link-local, or private RFC 1918 address. This allows the attacker to perform blind GET requests against internal services, bypassing `--allow-net` and `--deny-net` restrictions. While the attacker cannot read the full response body, they can infer the status of internal ports and services based on response timing and error messages. The issue is resolved in version 3.2.0 by implementing a capability-aware DNS resolver.
Affected products
- SurrealDB SurrealDB < 3.2.0
Timeline
- 2026-07-02: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: CVE published to NVD