{"affected":[{"defaultStatus":"unaffected","ecosystem":"cargo","packageName":"surrealdb","product":"surrealdb","source":"CNA: VulnCheck","vendor":"surrealdb","versions":[{"lessThan":"3.3.0","status":"affected","version":"3.1.0","versionType":"semver"},{"status":"unaffected","version":"3.3.0","versionType":"semver"}]}],"cveId":"CVE-2026-121421","cwes":["CWE-918"],"description":"SurrealDB 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability in network-capability matching because port-specific --deny-net rules (HOST:PORT or IP:PORT) match only a literal host string, while the resolved-IP check discards the port. Authenticated users can call http::* functions with a hostname resolving to a denied IP, or the IP of a denied hostname, to reach blocked internal services.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L","version":"4.0"},{"score":4.3,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}],"modifiedAt":1793716098001,"publishedAt":1793716098001,"references":[{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-mhv5-88p6-w4c3"},{"source":"CNA: VulnCheck","tags":["patch"],"url":"https://github.com/surrealdb/surrealdb/commit/9d9a5b0693e499e0d030cac6b618062ec02cd2bc"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/surrealdb-3.1.0-before-3.3.0-ssrf-via-port-specific-deny-net-host-aliasing-bypass"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/surrealdb/surrealdb/commit/9d9a5b0693e499e0d030cac6b618062ec02cd2bc"}],"revision":"d7c7392d3e8c668cfb4fa0f71773bf3e19037a8adbf463ab9f8f41c6be5dcf7f","sources":[{"modifiedAt":1793716098001,"name":"CNA: VulnCheck","retrievedAt":1793718569465,"url":"https://www.cve.org/CVERecord?id=CVE-2026-121421"}],"ssvc":null,"status":"published","title":"SurrealDB 3.1.0 before 3.3.0 SSRF via Port-Specific --deny-net Host Aliasing Bypass","updatedAt":1793718569465}