CVE-2026-121422

EUVD-2026-115954
SurrealDB from 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability that allows database Owners to bypass port-specific deny-net rules by using JWKS URLs with implicit default ports. Attackers can configure a JWT or record access method whose JWKS URL omits port 80 or 443, causing blind GET requests to explicitly denied internal services.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
4.1 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
surrealdbsurrealdb
3.1.0 ≤
𝑥
< 3.3.0
CNA
Common Weakness Enumeration
References
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-h3mp-7wcg-p6vj
https://www.vulncheck.com/advisories/surrealdb-from-3.1.0-before-3.3.0-ssrf-via-jwks-implicit-default-port-bypass