CVE-2026-121421

Name of the Vulnerable Software and Affected Versions SurrealDB versions 3.1.0 through 3.2.x

Description An issue exists in network-capability matching where port-specific --deny-net rules (formatted as HOST:PORT or IP:PORT) only match literal host strings, while the resolved-IP check ignores the port. This allows authenticated users to bypass network restrictions and reach blocked internal services by calling http::* functions using a hostname that resolves to a denied IP or by using the IP of a denied hostname. This is a server-side request forgery, which occurs when an attacker induces a server-side application to make requests to an unintended location.

Recommendations Update SurrealDB to version 3.3.0 or later.