Executive brief
SurrealDB is a multi-model database used for managing structured and unstructured data. A security flaw in how the database fetches authentication keys allows an administrative user to bypass network security rules. By redirecting the database's internal requests, an attacker could probe internal network services or cloud metadata that should otherwise be restricted, potentially leading to the exposure of internal infrastructure details.
Technical details
A Server-Side Request Forgery (SSRF) exists in SurrealDB's JWKS (JSON Web Key Set) fetching mechanism. The vulnerability occurs because the JWKS fetcher uses a reqwest client that follows HTTP redirects by default but only validates the initial URL against the --allow-net or --deny-net capabilities. An attacker with the 'Owner' role can configure a JWKS URL pointing to a controlled, allowlisted host that issues a 3xx redirect to a restricted internal address (such as 169.254.169.254 or localhost). While the fetch is 'blind' (the response body is not returned to the user), an attacker can infer the existence of internal services based on response timing and error messages. This issue was fixed in version 3.1.5 by implementing a redirect policy that re-validates every hop.
Affected products
- SurrealDB SurrealDB < 3.1.5
Timeline
- 2026-06-19: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: NVD publication date