CVE-2026-121420

Name of the Vulnerable Software and Affected Versions SurrealDB versions 3.2.0 through 3.2.x

Description An issue exists in the FilteringResolver is private ip check that fails to unwrap NAT64, 6to4, and Teredo IPv6 addresses. Authenticated users can exploit this by triggering outbound HTTP requests via SurrealQL http functions using transition addresses that embed private IPv4 targets. This allows access to localhost, internal services, or cloud metadata endpoints. Server-side request forgery is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

Recommendations Update SurrealDB to version 3.3.0.