CVEvulnerability

CVE-2025-71390

5.8 MEDIUM Published 2026-07-18 Modified 2026-09-29 Official page ↗
Status
Analyzed
Published
2026-07-18
Last modified
2026-09-29
Assigner
[email protected]
CVSS 4.0 ([email protected])
5.8 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-863

Description

SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames against --deny-net network access restrictions in its http::* functions. An authenticated user can invoke http::<fn>(<url>) with a hostname that resolves to a denied IP address, causing the server to issue the request anyway and return the response. This bypasses network access controls, allowing access to restricted internal endpoints and potentially retrieving or altering sensitive information and credentials, depending on the deployment.

Affected configurations

• surrealdb surrealdb (< 2.1.8) • surrealdb surrealdb (>= 2.2.0 < 2.2.6) • surrealdb surrealdb (>= 2.3.0 < 2.3.6) • surrealdb surrealdb 3.0.0

Related

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References