---
id: CVE-2026-121420
title: SurrealDB 3.2.0 before 3.3.0 SSRF Guard Bypass via IPv6 Transition Addresses
summary: >-
  SurrealDB from 3.2.0 before 3.3.0 contains a server-side request forgery
  vulnerability in the FilteringResolver is_private_ip check that fails to
  unwrap NAT64, 6to4, and Teredo IPv6 addresses. Authenticated users triggering
  outbound HTTP…
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-918
vendor: surrealdb
product: surrealdb
affected:
  - surrealdb >= 3.2.0 < 3.3.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T17:21:58.686277Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T18:30:25.488Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121420'
references:
  - url: >-
      https://github.com/surrealdb/surrealdb/security/advisories/GHSA-c9wc-jcr5-8974
    label: GitHub Security Advisory (GHSA-c9wc-jcr5-8974)
  - url: >-
      https://www.vulncheck.com/advisories/surrealdb-3.2.0-before-3.3.0-ssrf-guard-bypass-via-ipv6-transition-addresses
    label: >-
      VulnCheck Advisory: SurrealDB 3.2.0 before 3.3.0 SSRF Guard Bypass via
      IPv6 Transition Addresses
tags:
  - cve.org
epss: 0.00163
epssPercentile: 0.05587
ingestedAt: '2026-11-05T20:33:06.357Z'
---

## Overview

SurrealDB from 3.2.0 before 3.3.0 contains a server-side request forgery vulnerability in the FilteringResolver is_private_ip check that fails to unwrap NAT64, 6to4, and Teredo IPv6 addresses. Authenticated users triggering outbound HTTP requests via SurrealQL http functions can use transition addresses embedding private IPv4 targets to reach localhost, internal services, or cloud metadata endpoints.

## Affected

- `surrealdb >= 3.2.0 < 3.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.