Medium severity4.1NVD Advisory· Published Jul 20, 2026· Updated Jul 22, 2026
CVE-2026-63736
CVE-2026-63736
Description
SurrealDB before 3.2.0 contains a server-side request forgery vulnerability in the JWKS fetcher that validates only the URL hostname string against allow-lists without checking resolved IP addresses. An Owner role attacker can point an access method at an allow-listed hostname resolving to private or loopback addresses, causing the server to issue GET requests to internal addresses that would be blocked by direct URL.
Affected products
2Patches
Vulnerability mechanics
References
2- github.com/surrealdb/surrealdb/security/advisories/GHSA-5x4x-2946-qr67nvdVendor AdvisoryMitigation
- www.vulncheck.com/advisories/surrealdb-before-ssrf-via-jwks-url-hostname-resolutionnvdThird Party Advisory
News mentions
0No linked articles in our index yet.