Executive brief
SurrealDB is a multi-model database that includes functions for making web requests to external services. A security flaw allows users with database access to bypass network restrictions intended to block specific internal services or ports. By using a malicious web link that redirects to a forbidden internal address, an attacker could gain unauthorized access to sensitive internal systems like local databases or cloud metadata services.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in SurrealDB's outbound HTTP request handling. When processing an HTTP redirect (3xx response), the redirect policy in `surrealdb/core/src/fnc/util/http/mod.rs` constructs the target destination using only the host string while dropping the port number. Consequently, the capability matcher fails to apply port-scoped `--deny-net <host>:<port>` rules because it does not match port-stripped targets against port-bearing rules. An authenticated attacker permitted to use `http::*` functions can exploit this by directing a request to a permitted host that redirects to a denied host and port. This allows access to internal services that the operator explicitly intended to block. The issue is fixed in version 3.1.0 by ensuring the port is preserved during redirect target construction.
Affected products
- SurrealDB SurrealDB < 3.1.0
Timeline
- 2026-05-27: disclosed
- 2026-05-27: patched: Fixed in version 3.1.0
- 2026-07-01: advisory