Server-Side Request Forgery in SurrealDB Impacting Network Security

CVE-2026-63744

What is CVE-2026-63744?

SurrealDB prior to version 3.1.5 is exposed to a server-side request forgery (SSRF) vulnerability found in the JWKS fetcher. This issue arises as the application follows HTTP redirects while failing to re-validate redirect targets against defined network capabilities. Malicious actors with Owner role privileges can manipulate the configuration to point a JWKS URL to an allowlisted host. Consequently, this host may redirect requests to internal addresses that should normally be inaccessible due to network access controls, effectively bypassing security measures.

References