CVE-2026-121422

Name of the Vulnerable Software and Affected Versions SurrealDB versions 3.1.0 through 3.2.x

Description An issue exists where database Owners can bypass port-specific deny-net rules. This occurs when using JSON Web Key Set (JWKS) URLs that utilize implicit default ports. By configuring a JWT or record access method with a JWKS URL that omits port 80 or 443, an attacker can trigger blind GET requests to internal services that were explicitly denied.

Recommendations Update SurrealDB to version 3.3.0 or later.