CVE-2026-63744 in SurrealDB
Summary
by MITRE • 07/20/2026
SurrealDB before 3.1.5 contains a server-side request forgery vulnerability in the JWKS fetcher that follows HTTP redirects without re-validating redirect targets against network capabilities. Attackers with Owner role can configure a JWKS URL pointing to an allowlisted host that redirects to blocked internal addresses, bypassing network access controls.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/20/2026
The vulnerability exists within SurrealDB versions prior to 3.1.5 and represents a critical server-side request forgery flaw in the JSON Web Key Set (JWKS) fetcher component. This weakness allows attackers with Owner role privileges to manipulate the system's ability to retrieve cryptographic keys from external sources by exploiting improper redirect handling mechanisms.
The technical flaw manifests when the JWKS fetcher processes HTTP redirects without performing additional validation of the final redirect target against the system's network capabilities and access controls. When an attacker configures a JWKS URL that points to an allowlisted host, the system will follow the redirect chain and ultimately reach internal addresses that would normally be blocked by network access controls. This occurs because the initial validation only checks the original URL against allowlists, not the final destination of any redirects that may occur during the fetch process.
This vulnerability operates under the broader context of improper input validation and network security controls, aligning with CWE-610 which addresses external control of System or Configuration Setting and CWE-943 which covers improper restriction of operations within a blacklisted or whitelisted directory. The flaw enables attackers to bypass network access controls that are typically designed to prevent direct connections to internal systems, creating a path for unauthorized access to protected resources.
The operational impact is significant for organizations using SurrealDB, as it allows privilege escalation from Owner role to potentially unrestricted system access. Attackers can leverage this vulnerability to access internal services, databases, or network resources that should normally be isolated from external access. The attack vector requires only the ability to configure JWKS settings within the database, which is typically available to users with Owner privileges, making it particularly dangerous in environments where such permissions are granted to less privileged users.
The mitigation strategy involves updating to SurrealDB version 3.1.5 or later, which implements proper redirect validation mechanisms that re-evaluate all redirect targets against network capabilities and access controls. Organizations should also consider implementing additional monitoring for JWKS configuration changes and network connections initiated by the database system. Security teams should review existing network access controls to ensure they properly account for potential redirect scenarios, and implement principle of least privilege practices to limit who can configure external resource access parameters within the database environment. This vulnerability demonstrates the importance of comprehensive input validation and proper security control enforcement throughout entire request chains rather than just at initial entry points.
The attack pattern aligns with ATT&CK technique T1078 004 which covers valid accounts with cloud access, and T1566 002 which involves phishing via email with malicious links. The vulnerability exposes a gap in the security model where legitimate network access is extended through improper redirect handling, allowing attackers to leverage trusted connections for unauthorized access attempts. Organizations should implement regular security assessments of their database configurations and ensure that all external resource access points properly validate the complete request chain rather than just initial parameters.