Is CVE-2026-63743 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63743 being exploited in the wild.

How severe is CVE-2026-63743?

Medium severity, with a CVSS score of 6.4, published 20 July 2026.

Which products and versions are affected?

surrealdb (crates.io) SEMVER:introduced=0,fixed=3.1.0.

Is there a fix for CVE-2026-63743?

Yes. surrealdb (crates.io): upgrade to 3.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63743 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-63743?

Check whether you run surrealdb (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63743: SurrealDB capability bypass in HTTP redirect handling

CVE-2026-63743 · Severity: medium · CVSS 6.4 · Published 2026-07-20

SurrealDB is a multi-model database that includes functions for making external web requests. A security flaw allows authenticated users to bypass network restrictions intended to block access to specific internal services or ports. By using a malicious web redirect, an attacker could force the database to connect to restricted internal systems, potentially leading to unauthorized data access or interaction with sensitive internal infrastructure.

Technologies: surrealdb (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-63743 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63743 being exploited in the wild.
How severe is CVE-2026-63743?: Medium severity, with a CVSS score of 6.4, published 20 July 2026.
Which products and versions are affected?: surrealdb (crates.io) SEMVER:introduced=0,fixed=3.1.0.
Is there a fix for CVE-2026-63743?: Yes. surrealdb (crates.io): upgrade to 3.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63743 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-63743?: Check whether you run surrealdb (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

surrealdb (crates.io): upgrade to 3.1.0 or later
```
cargo update -p surrealdb
```

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in SurrealDB's HTTP function handling due to improper validation of redirect targets. When an outbound HTTP request is redirected (3xx response), the redirect policy in `surrealdb/core/src/fnc/util/http/mod.rs` strips the port information from the destination URL before checking it against the `--deny-net` capability list. Because the capability matcher fails to compare port-specific rules against these port-stripped targets, the restriction is ignored. An authenticated attacker can exploit this by hosting a redirector on a permitted domain that points to a restricted `host:port` combination. This allows access to internal services like Redis or cloud metadata services that were explicitly denied by port-scoped rules. The issue is fixed in version 3.1.0 by ensuring the port is preserved during redirect evaluation.

Affected products

SurrealDB SurrealDB < 3.1.0

Identifiers

CVE-2026-63743
GHSA-97vg-427p-8hx5

Timeline

2026-05-27: advisory: GitHub Security Advisory published
2026-07-20: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.