Executive brief
SurrealDB is a database platform that includes HTTP functions for accessing external network resources, with --deny-net rules used to restrict which network targets authenticated users can reach. A vulnerability in redirect handling allows authenticated users to bypass port-specific access controls by initiating a request to an allowed hostname that redirects to a blocked internal service (such as a local database or metadata endpoint). This could expose sensitive internal systems to unauthorized access by authenticated database users.
Technical details
SurrealDB's HTTP redirect policy fails to preserve port information when constructing the NetTarget for redirect destinations. The vulnerable code in surrealdb/core/src/fnc/util/http/mod.rs extracts only url.host_str() and drops url.port(), while the capability matcher in surrealdb/core/src/dbs/capabilities.rs refuses to match port-bearing rules against port-stripped targets. This allows an authenticated attacker to chain a 3xx redirect from an --allow-net-permitted hostname to a denied host:port, bypassing the denial. The attack requires the attacker to already have http::* function access and control a redirect target. Host-only deny rules are not affected because they match port-stripped targets. Version 3.1.0 and later patch this by including url.port() in the NetTarget construction for redirects, and regression tests verify the fix.
Affected products
- SurrealDB SurrealDB < 3.1.0
Timeline
- 2026-05-27: disclosed
- 2026-07-20: advisory: GHSA-97vg-427p-8hx5 published; CVE-2026-63743 assigned
- 2026-05-27: patched: Version 3.1.0 released with fix (commit ceb1ca3a1)
- 2026-09-04: other: GHSA-vq7c-3hc9-m5hr withdrawn as duplicate of GHSA-97vg-427p-8hx5