CVE-2026-63743: SurrealDB Auth Bypass Vulnerability

CVE-2026-63743 Overview

CVE-2026-63743 is a capability bypass vulnerability in SurrealDB versions before 3.1.0. The flaw resides in HTTP redirect handling and allows authenticated users to circumvent port-scoped --deny-net rules. An attacker chains an HTTP redirect from an allowed hostname to a denied host:port combination. The redirect follows because port information is dropped during redirect policy evaluation. This weakness maps to CWE-918: Server-Side Request Forgery. The issue enables restricted network access from within SurrealDB, undermining the network isolation controls administrators configure to protect internal services.

Critical Impact
Authenticated users can bypass port-specific network deny rules and reach internal services that should be blocked, expanding the SSRF attack surface within SurrealDB deployments.

Affected Products

SurrealDB versions prior to 3.1.0
Deployments relying on port-scoped --deny-net capability rules
Any SurrealDB instance permitting authenticated user-driven HTTP requests

Discovery Timeline

2026-07-20 - CVE-2026-63743 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-63743

Vulnerability Analysis

SurrealDB exposes capabilities that let operators restrict outbound network access using flags such as --allow-net and --deny-net. These rules can be scoped to specific host:port combinations, letting administrators permit an allowed hostname while denying access to sensitive backend ports on the same or related hosts. The vulnerability breaks this scoping model when the server processes HTTP redirects. An initial request targets an allowed endpoint. The remote server responds with a redirect pointing to a denied host:port target. When SurrealDB re-evaluates the redirect against the deny list, the port component is dropped from the comparison, so the redirected request is treated as permitted and executed.

Root Cause

The root cause is inconsistent policy evaluation between the initial request path and the redirect path. Port information is stripped before the deny-net rule is consulted on the follow-up request. This turns a port-specific deny rule into a host-only check, which the attacker satisfies by pointing the redirect at a host the operator intended to allow only on a public port.

Attack Vector

An authenticated SurrealDB user issues an outbound HTTP function call to an attacker-controlled host that is explicitly allowed. The attacker's server returns a 3xx response with a Location header pointing to an internal target such as http://internal-service:8080/. SurrealDB follows the redirect despite a matching --deny-net rule for that port. The attacker then reaches internal services, metadata endpoints, or admin ports that would otherwise be blocked. See the VulnCheck advisory and the GitHub Security Advisory GHSA-97vg-427p-8hx5 for further technical detail.

Detection Methods for CVE-2026-63743

Indicators of Compromise

Outbound HTTP requests from SurrealDB followed immediately by requests to internal IP ranges or non-public ports
SurrealDB query logs containing HTTP functions targeting external hosts that then redirect to RFC1918 addresses or localhost
Unexpected connections from the SurrealDB process to ports listed in --deny-net rules

Detection Strategies

Correlate SurrealDB outbound HTTP calls with subsequent connections that violate documented network segmentation policies.
Alert on any redirect chain terminating at an internal host or port that appears in the configured --deny-net list.
Inspect HTTP response headers logged by egress proxies for Location values pointing to internal targets when the initial destination was external.

Monitoring Recommendations

Route SurrealDB egress traffic through an explicit proxy that enforces host and port allow lists independently of the database.
Enable verbose logging of the SurrealDB HTTP client, including redirect chains, and forward logs to a centralized analytics platform.
Monitor for authenticated queries invoking HTTP functions from user roles that do not require outbound network access.

How to Mitigate CVE-2026-63743

Immediate Actions Required

Upgrade SurrealDB to version 3.1.0 or later, where redirect handling preserves port information during capability evaluation.
Audit existing --allow-net and --deny-net configurations and remove any assumption that port scoping is enforced on redirects in pre-3.1.0 releases.
Revoke or restrict HTTP function permissions for user roles that do not require outbound network access.

Patch Information

SurrealDB addressed the issue in release 3.1.0. Refer to the GitHub Security Advisory GHSA-97vg-427p-8hx5 for the fix commit and upgrade guidance.

Workarounds

Disable HTTP outbound functions entirely by setting --deny-net to a broad rule or using --deny-funcs http where feasible.
Enforce network segmentation at the host or container level so SurrealDB cannot reach internal services regardless of application-layer checks.
Front SurrealDB egress traffic with a filtering proxy that validates both host and port on every hop, including redirects.

bash

# Configuration example: block all outbound HTTP from SurrealDB
surreal start \
  --deny-net '*' \
  --deny-funcs 'http::*' \
  file://data