PT-2026-136179
CVE-2026-121422
·
Published
2026-11-03
·
Updated
2026-11-03
Description by
CVSS 3.1
4.1
MediumMetricsAV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
SurrealDB from 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability that allows database Owners to bypass port-specific deny-net rules by using JWKS URLs with implicit default ports. Attackers can configure a JWT or record access method whose JWKS URL omits port 80 or 443, causing blind GET requests to explicitly denied internal services.
Found an issue in the description? Have something to add? Feel free to write us 👾