CVE-2026-121420

EUVD-2026-115952
SurrealDB from 3.2.0 before 3.3.0 contains a server-side request forgery vulnerability in the FilteringResolver is_private_ip check that fails to unwrap NAT64, 6to4, and Teredo IPv6 addresses. Authenticated users triggering outbound HTTP requests via SurrealQL http functions can use transition addresses embedding private IPv4 targets to reach localhost, internal services, or cloud metadata endpoints.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
3.3 LOW
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
surrealdbsurrealdb
3.2.0 ≤
𝑥
< 3.3.0
CNA
Common Weakness Enumeration
References
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-c9wc-jcr5-8974
https://www.vulncheck.com/advisories/surrealdb-3.2.0-before-3.3.0-ssrf-guard-bypass-via-ipv6-transition-addresses