Executive brief
SurrealDB is a multi-model database that includes functions for making external web requests. A security flaw allows authenticated users to bypass network restrictions intended to block access to specific internal services or ports. By using a malicious web redirect, an attacker could force the database to connect to restricted internal systems, potentially leading to unauthorized data access or interaction with sensitive internal infrastructure.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in SurrealDB's HTTP function handling due to improper validation of redirect targets. When an outbound HTTP request is redirected (3xx response), the redirect policy in `surrealdb/core/src/fnc/util/http/mod.rs` strips the port information from the destination URL before checking it against the `--deny-net` capability list. Because the capability matcher fails to compare port-specific rules against these port-stripped targets, the restriction is ignored. An authenticated attacker can exploit this by hosting a redirector on a permitted domain that points to a restricted `host:port` combination. This allows access to internal services like Redis or cloud metadata services that were explicitly denied by port-scoped rules. The issue is fixed in version 3.1.0 by ensuring the port is preserved during redirect evaluation.
Affected products
- SurrealDB SurrealDB < 3.1.0
Timeline
- 2026-05-27: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: NVD publication date