CVE-2026-63736: SurrealDB SSRF Vulnerability

CVE-2026-63736 Overview

CVE-2026-63736 is a server-side request forgery (SSRF) vulnerability in SurrealDB versions before 3.2.0. The flaw resides in the JSON Web Key Set (JWKS) fetcher, which validates only the URL hostname string against configured allow-lists. The fetcher does not check the resolved IP addresses returned by DNS. An attacker holding the Owner role can point an access method at an allow-listed hostname that resolves to private or loopback addresses. The server then issues GET requests to internal endpoints that would otherwise be blocked when accessed by direct URL. The weakness is tracked as CWE-918.

Critical Impact
Authenticated Owner-role users can coerce SurrealDB into issuing HTTP requests to internal network resources, enabling reconnaissance of otherwise unreachable services.

Affected Products

SurrealDB versions prior to 3.2.0
Deployments exposing JWKS-backed authentication access methods
Instances where administrators rely on hostname allow-lists for outbound URL restrictions

Discovery Timeline

2026-07-20 - CVE-2026-63736 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-63736

Vulnerability Analysis

SurrealDB supports JWT-based authentication where access methods reference external JWKS endpoints. When SurrealDB fetches keys, it consults an allow-list to decide whether the destination URL is permitted. The check compares the hostname string extracted from the URL against the allow-listed entries and stops there. DNS resolution occurs afterwards inside the HTTP client, and the resulting IP address is never re-evaluated against network-level restrictions.

An attacker with Owner privileges can register an allow-listed hostname that resolves under attacker control, or exploit an existing allow-listed hostname that maps to private space such as 127.0.0.1, 169.254.169.254, or RFC1918 ranges. SurrealDB then issues an HTTP GET to the internal address. Because the request originates from the database server, it bypasses perimeter controls that would block direct external access.

Root Cause

The root cause is incomplete validation of destination targets in the JWKS fetcher. Trust is placed in the hostname literal rather than the final resolved network endpoint. This creates a classic time-of-check to time-of-use gap between allow-list evaluation and socket connection.

Attack Vector

Exploitation requires network access to SurrealDB and valid Owner credentials. The attacker configures an access method whose JWKS URL points at an allow-listed hostname that resolves internally. Triggering the token verification path forces SurrealDB to fetch the JWKS. The server-side request is directed at the internal IP, producing SSRF against services reachable from the database host. Detailed root-cause commentary appears in the VulnCheck SSRF Advisory.

No public proof-of-concept code is available. The vulnerability mechanism is described in prose in the GitHub Security Advisory GHSA-5x4x-2946-qr67.

Detection Methods for CVE-2026-63736

Indicators of Compromise

Outbound HTTP GET requests from the SurrealDB process to 127.0.0.0/8, 169.254.0.0/16, or RFC1918 address ranges
Access method definitions referencing JWKS URLs whose DNS records resolve to internal IP space
Unexpected DEFINE ACCESS or ALTER ACCESS statements executed by Owner-role accounts

Detection Strategies

Audit SurrealDB configuration for all defined access methods and enumerate their JWKS URLs, then resolve each hostname to confirm it maps only to intended external endpoints.
Instrument the host firewall or eBPF-based telemetry to log outbound connections initiated by the SurrealDB binary and alert on destinations inside the internal network.
Review authentication logs for unusual Owner-role activity, particularly modifications to access methods followed by token verification attempts.

Monitoring Recommendations

Forward SurrealDB audit logs and host network telemetry to a centralized analytics platform for correlation between access-method changes and outbound traffic.
Baseline the set of external hosts SurrealDB legitimately contacts and alert on deviations, especially connections to metadata endpoints such as 169.254.169.254.
Track privileged role assignments and revoke unused Owner grants to shrink the population that can trigger JWKS fetches.

How to Mitigate CVE-2026-63736

Immediate Actions Required

Upgrade SurrealDB to version 3.2.0 or later, where the JWKS fetcher validates resolved IP addresses in addition to the hostname string.
Inventory Owner-role accounts and enforce least privilege, revoking the role from any principal that does not require full administrative control.
Restrict egress from SurrealDB hosts at the network layer so the process cannot reach internal management interfaces or cloud metadata services.

Patch Information

The fix is included in SurrealDB 3.2.0. Upgrade guidance and the coordinated advisory are published in the GitHub Security Advisory GHSA-5x4x-2946-qr67. Operators running earlier 3.x releases should plan an immediate upgrade.

Workarounds

Place SurrealDB in a network segment that denies outbound traffic to private, loopback, and link-local address ranges by default, permitting only explicit external identity providers.
Remove or restrict JWKS-based access methods until the upgrade is applied, favoring authentication mechanisms that do not require server-initiated HTTP fetches.
Monitor DNS responses for allow-listed hostnames and alert if any record resolves into internal address space, indicating potential abuse or misconfiguration.

bash

# Example egress restriction using iptables to block SurrealDB from reaching internal ranges
iptables -A OUTPUT -m owner --uid-owner surrealdb -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner surrealdb -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner surrealdb -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner surrealdb -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner surrealdb -d 169.254.0.0/16 -j REJECT