Server-Side Request Forgery in SurrealDB by SurrealDB

CVE-2026-121420

What is CVE-2026-121420?

SurrealDB versions prior to 3.3.0 have a vulnerability in the FilteringResolver's is_private_ip check, which does not properly handle NAT64, 6to4, and Teredo IPv6 addresses. This flaw allows authenticated users to exploit outbound HTTP requests through SurrealQL functions, potentially accessing localhost, internal services, or cloud metadata endpoints by embedding private IPv4 targets within transition addresses. This misuse poses a significant risk as it can lead to unauthorized access to sensitive information and system resources.

References