{"id":"CVE-2026-121420","title":"SurrealDB 3.2.0 before 3.3.0 SSRF Guard Bypass via IPv6 Transition Addresses","summary":"SurrealDB from 3.2.0 before 3.3.0 contains a server-side request forgery vulnerability in the FilteringResolver is_private_ip check that fails to unwrap NAT64, 6to4, and Teredo IPv6 addresses. Authenticated users triggering outbound HTTP…","severity":"low","cvss":3.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvssSource":"cna","cwe":["CWE-918"],"vendor":"surrealdb","product":"surrealdb","affected":["surrealdb >= 3.2.0 < 3.3.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-03T17:21:58.686277Z"},"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T18:30:25.488Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-121420","references":[{"url":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-c9wc-jcr5-8974","label":"GitHub Security Advisory (GHSA-c9wc-jcr5-8974)"},{"url":"https://www.vulncheck.com/advisories/surrealdb-3.2.0-before-3.3.0-ssrf-guard-bypass-via-ipv6-transition-addresses","label":"VulnCheck Advisory: SurrealDB 3.2.0 before 3.3.0 SSRF Guard Bypass via IPv6 Transition Addresses"}],"tags":["cve.org"],"epss":0.00163,"epssPercentile":0.05587,"ingestedAt":"2026-11-05T20:33:06.357Z","slug":"CVE-2026-121420","body":"## Overview\n\nSurrealDB from 3.2.0 before 3.3.0 contains a server-side request forgery vulnerability in the FilteringResolver is_private_ip check that fails to unwrap NAT64, 6to4, and Teredo IPv6 addresses. Authenticated users triggering outbound HTTP requests via SurrealQL http functions can use transition addresses embedding private IPv4 targets to reach localhost, internal services, or cloud metadata endpoints.\n\n## Affected\n\n- `surrealdb >= 3.2.0 < 3.3.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":18,"depthScoreParts":{"impact":18.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}