CVE-2026-63743 in SurrealDB
Summary
by MITRE • 07/20/2026
SurrealDB before 3.1.0 contains a capability bypass vulnerability in HTTP redirect handling that allows authenticated users to circumvent port-scoped --deny-net rules. Attackers can chain an HTTP redirect from an allowed hostname to a denied host:port combination, and the redirect is followed because the port information is dropped during redirect policy evaluation.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability exists in SurrealDB versions prior to 3.1.0 and represents a critical capability bypass flaw in the database's HTTP redirect handling mechanism. The issue stems from how the system evaluates network access policies when processing HTTP redirects, specifically failing to maintain port scope validation during the redirect process. When an authenticated user initiates an HTTP request that results in a redirect, the system incorrectly processes the redirect by stripping port information from the policy evaluation, allowing malicious actors to bypass configured --deny-net rules that should prevent connections to specific host:port combinations. The flaw operates through a chain of events where an attacker first accesses a hostname that is permitted by network policies, then follows an HTTP redirect to a denied host:port combination that would normally be blocked. This occurs because the policy evaluation logic does not properly account for port information when determining whether to allow or deny redirected requests, creating a pathway for authenticated users to access restricted network resources that should be protected by the denial rules.
The technical implementation of this vulnerability demonstrates a clear failure in network policy enforcement during HTTP redirect processing, which aligns with CWE-693 weakness category related to protection mechanism failures. The flaw essentially creates an authorization bypass where legitimate network restrictions are circumvented through manipulation of the HTTP redirect chain, allowing attackers to establish connections to denied endpoints that would otherwise be blocked by the --deny-net configuration. This represents a significant compromise in the principle of least privilege as authenticated users can potentially access network resources outside their intended scope. The vulnerability's impact is amplified because it requires only authentication to exploit, making it particularly dangerous in environments where administrative or elevated access is available through legitimate user accounts.
The operational consequences of this vulnerability are severe for SurrealDB deployments that rely on network isolation and port-scoped access controls for security. Attackers could leverage this flaw to access internal services, databases, or network resources that should be protected behind the --deny-net restrictions, potentially leading to data exfiltration, lateral movement within networks, or exploitation of vulnerable systems. The ability to chain HTTP redirects from allowed to denied endpoints creates a sophisticated attack vector that bypasses traditional network segmentation controls, undermining the security posture of organizations relying on SurrealDB for database operations. Additionally, this vulnerability may enable attackers to probe internal network configurations and identify additional attack surfaces that would normally be protected by the configured access policies.
Organizations should immediately upgrade to SurrealDB version 3.1.0 or later where this capability bypass has been addressed through enhanced HTTP redirect handling and proper port information preservation during policy evaluation. Network administrators should review existing --deny-net configurations to ensure they are properly enforced, while security teams should monitor for potential exploitation attempts involving HTTP redirect chains. The mitigation strategy should include implementing additional network monitoring to detect unusual redirect patterns and establishing more granular access controls beyond simple hostname-based restrictions. This vulnerability highlights the importance of thorough testing of network policy enforcement mechanisms during HTTP request processing, particularly in applications that handle user-initiated redirects, as the failure to maintain scope consistency between original requests and redirected requests can create significant security gaps in network defense strategies.