CVE-2026-63744

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.5

Description A server-side request forgery (SSRF) issue exists in the JWKS fetcher. The system follows HTTP redirects without re-validating the redirect targets against network capabilities. Users with the Owner role can configure a JWKS URL pointing to an allowlisted host that redirects to blocked internal addresses, allowing them to bypass network access controls.

Recommendations Update SurrealDB to version 3.1.5 or later.