---
id: CVE-2026-121421
title: >-
  SurrealDB 3.1.0 before 3.3.0 SSRF via Port-Specific --deny-net Host Aliasing
  Bypass
summary: >-
  SurrealDB 3.1.0 before 3.3.0 contains a server-side request forgery
  vulnerability in network-capability matching because port-specific --deny-net
  rules (HOST:PORT or IP:PORT) match only a literal host string, while the
  resolved-IP check …
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-918
vendor: surrealdb
product: surrealdb
affected:
  - surrealdb >= 3.1.0 < 3.3.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T17:03:19.676030Z'
exploitAvailable: true
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T17:04:02.980Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121421'
references:
  - url: >-
      https://github.com/surrealdb/surrealdb/security/advisories/GHSA-mhv5-88p6-w4c3
    label: GitHub Security Advisory (GHSA-mhv5-88p6-w4c3)
  - url: >-
      https://github.com/surrealdb/surrealdb/commit/9d9a5b0693e499e0d030cac6b618062ec02cd2bc
    label: Patch Commit
  - url: >-
      https://www.vulncheck.com/advisories/surrealdb-3.1.0-before-3.3.0-ssrf-via-port-specific-deny-net-host-aliasing-bypass
    label: >-
      VulnCheck Advisory: SurrealDB 3.1.0 before 3.3.0 SSRF via Port-Specific
      --deny-net Host Aliasing Bypass
tags:
  - cve.org
  - exploit-available
epss: 0.00333
epssPercentile: 0.2663
ingestedAt: '2026-11-05T20:33:06.301Z'
---

## Overview

SurrealDB 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability in network-capability matching because port-specific --deny-net rules (HOST:PORT or IP:PORT) match only a literal host string, while the resolved-IP check discards the port. Authenticated users can call http::* functions with a hostname resolving to a denied IP, or the IP of a denied hostname, to reach blocked internal services.

## Affected

- `surrealdb >= 3.1.0 < 3.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.