CVE-2026-121422 in SurrealDB
Summary
by MITRE • 11/03/2026
SurrealDB from 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability that allows database Owners to bypass port-specific deny-net rules by using JWKS URLs with implicit default ports. Attackers can configure a JWT or record access method whose JWKS URL omits port 80 or 443, causing blind GET requests to explicitly denied internal services.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in SurrealDB versions prior to 3.3.0 represents a critical security flaw rooted in the improper handling of Uniform Resource Identifiers within JSON Web Key Set resolution mechanisms. This server-side request forgery issue specifically affects database Owners, who possess elevated privileges allowing them to configure authentication methods and record access rules involving external identity providers. The core technical deficiency lies in how the application parses JWKS URLs that omit explicit port specifications for standard protocols such as HTTP or HTTPS. When a URL omits the port number, the underlying network stack implicitly defaults to port 80 for unencrypted connections or port 443 for encrypted ones, regardless of any existing deny-net rules designed to block access to specific internal ports or services.
This behavior creates a significant bypass mechanism against network segmentation policies enforced by the database configuration. Administrators often implement strict allow-lists and deny-lists to prevent the database engine from making outbound requests to sensitive internal infrastructure, such as metadata stores, secret managers, or other microservices residing on non-standard ports. By leveraging JWKS URLs that do not explicitly state a port number, an attacker can trigger blind GET requests directed at these protected internal services via their default ports. Since the deny-net rules are typically configured to block specific explicit ports rather than all traffic to certain hostnames regardless of port, this implicit resolution effectively circumvents the intended security controls. The attack does not require direct interaction with the target service but relies on the server making an outbound request that is subsequently blocked or allowed based on flawed logic regarding default port assumptions.
The operational impact of this vulnerability allows authenticated Owners to potentially access internal resources that should remain isolated from database operations. This can lead to unauthorized data exfiltration, lateral movement within the network if those internal services are compromised via subsequent exploitation chains, or denial of service through resource exhaustion caused by repeated blind requests. The severity is compounded by the fact that it exploits a trust relationship between the authentication mechanism and the network security policies. An attacker who has gained Owner-level access can use this flaw to probe internal networks, map out available services on default ports, and potentially extract sensitive information if those services respond with data or error messages revealing their existence.
From a classification perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF), specifically involving the bypass of access control mechanisms through ambiguous URI parsing. It also relates to CWE-20 Improper Input Validation, as the application fails to correctly validate or normalize the port component of URLs before resolving them against security policies. In terms of offensive tactics, this technique corresponds to ATT&CK T1598 Phishing for Information within a Host and potentially T1608 Staged Capabilities if used to download additional payloads from internal repositories. The flaw highlights the importance of strict normalization of network identifiers in server-side applications that perform outbound requests on behalf of users.
Mitigation strategies must focus on both immediate patching and long-term architectural improvements. The primary remediation is to upgrade SurrealDB to version 3.3.0 or later, where this parsing logic has been corrected to ensure explicit port requirements are enforced even when defaults might apply. In the interim, administrators should enforce strict input validation at the application layer by rejecting any JWKS URLs that do not explicitly specify a port number for HTTP and HTTPS protocols. Additionally, network-level controls such as firewalls or service meshes can be configured to block outbound traffic on default ports 80 and 443 from database hosts unless absolutely necessary, adding a defense-in-depth layer against this bypass technique. Regular audits of deny-net rules should also include testing with various URL formats to ensure no implicit defaults are being exploited by misconfigured authentication providers or malicious actors.