CVE-2026-63736

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.2.0

Description A server-side request forgery (SSRF) issue exists in the JWKS fetcher. The system validates the URL hostname string against allow-lists but fails to verify the resolved IP addresses. An attacker with the Owner role can configure an access method using an allow-listed hostname that resolves to private or loopback addresses, forcing the server to send GET requests to internal addresses that are otherwise blocked by direct URL access.

Recommendations Update SurrealDB to version 3.2.0 or later.