Server-Side Request Forgery Vulnerability in SurrealDB by SurrealDB

CVE-2026-63736

What is CVE-2026-63736?

SurrealDB versions prior to 3.2.0 are vulnerable to a server-side request forgery (SSRF) issue in the JWKS fetcher. The vulnerability arises because the software only validates the URL hostname against a set of allow-lists, without validating the resolved IP addresses. This flaw allows an attacker with Owner role access to leverage allowed hostname points that resolve to internal or loopback addresses, which can lead to the server making unauthorized GET requests to potentially sensitive internal resources that would otherwise be protected from external access.

References