{"id":"CVE-2026-121422","title":"SurrealDB from 3.1.0 before 3.3.0 SSRF via JWKS Implicit Default Port Bypass","summary":"SurrealDB from 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability that allows database Owners to bypass port-specific deny-net rules by using JWKS URLs with implicit default ports. Attackers can configure a JWT or re…","severity":"medium","cvss":4.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-918"],"vendor":"surrealdb","product":"surrealdb","affected":["surrealdb >= 3.1.0 < 3.3.0"],"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T14:28:18.699Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-121422","references":[{"url":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-h3mp-7wcg-p6vj","label":"GitHub Security Advisory (GHSA-h3mp-7wcg-p6vj)"},{"url":"https://www.vulncheck.com/advisories/surrealdb-from-3.1.0-before-3.3.0-ssrf-via-jwks-implicit-default-port-bypass","label":"VulnCheck Advisory: SurrealDB from 3.1.0 before 3.3.0 SSRF via JWKS Implicit Default Port Bypass"}],"tags":["cve.org"],"epss":0.00246,"epssPercentile":0.15939,"ingestedAt":"2026-11-05T19:30:42.966Z","slug":"CVE-2026-121422","body":"## Overview\n\nSurrealDB from 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability that allows database Owners to bypass port-specific deny-net rules by using JWKS URLs with implicit default ports. Attackers can configure a JWT or record access method whose JWKS URL omits port 80 or 443, causing blind GET requests to explicitly denied internal services.\n\n## Affected\n\n- `surrealdb >= 3.1.0 < 3.3.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":23,"depthScoreParts":{"impact":22.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}