CVE-2026-63744 Overview
CVE-2026-63744 is a server-side request forgery (SSRF) vulnerability affecting SurrealDB versions prior to 3.1.5. The flaw resides in the JSON Web Key Set (JWKS) fetcher, which follows HTTP redirects without re-validating redirect targets against configured network capabilities. An attacker with the Owner role can configure a JWKS URL that points to an allowlisted external host, then chain that host to redirect the fetcher toward blocked internal addresses. This bypasses SurrealDB's network access controls and allows probing of internal services otherwise unreachable from the database process. The weakness is categorized as [CWE-918].
Critical Impact
Authenticated Owner-role users can pivot the SurrealDB server into internal networks, enabling reconnaissance of otherwise inaccessible metadata services and infrastructure endpoints.
Affected Products
- SurrealDB versions prior to 3.1.5
- Deployments using the JWKS fetcher for JWT authentication
- Environments relying on SurrealDB network capability allowlists for isolation
Discovery Timeline
- 2026-07-20 - CVE-2026-63744 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-63744
Vulnerability Analysis
SurrealDB supports JWT-based authentication using remote JWKS endpoints. When a token is validated, the server fetches the referenced JWKS URL to retrieve signing keys. Network capability settings restrict which hosts the database may contact, typically blocking internal ranges such as 127.0.0.0/8, 169.254.169.254, and RFC1918 addresses.
The fetcher validates the initial URL against the allowlist but does not re-apply the same checks to Location headers returned during HTTP redirect handling. An attacker with Owner privileges configures a JWKS URL on an allowlisted domain they control. That host responds with a 3xx redirect pointing to an internal address. The fetcher follows the redirect and issues a request the network policy was designed to block.
Root Cause
The root cause is missing revalidation of redirect targets inside the JWKS fetch routine. Capability enforcement occurs once, at the pre-flight stage, rather than on every hop of the HTTP transaction. This is a canonical [CWE-918] SSRF pattern where trust in the initial destination is incorrectly extended to subsequent destinations.
Attack Vector
Exploitation requires authenticated access at the Owner role, which limits the attacker population to privileged database administrators or accounts compromised through other means. The attacker updates the authentication configuration to reference an external HTTP endpoint under their control. That endpoint issues a redirect to an internal address such as a cloud metadata service or an internal HTTP API. When SurrealDB attempts key retrieval, the resulting request reaches the internal target. Response contents may not be directly returned to the caller, but timing, error signatures, and side effects can be used to enumerate internal services. Consult the VulnCheck Advisory on SSRF for further technical detail.
No verified public exploit code is available. See the GitHub Security Advisory for the maintainer description.
Detection Methods for CVE-2026-63744
Indicators of Compromise
- Outbound HTTP requests from the SurrealDB process to unexpected internal addresses, cloud metadata endpoints (169.254.169.254), or loopback ranges.
- JWKS URL configuration changes performed by Owner-role accounts, particularly URLs pointing to newly registered or attacker-controlled domains.
- HTTP 3xx responses returned to the SurrealDB fetcher followed by requests to non-allowlisted destinations.
Detection Strategies
- Correlate SurrealDB audit logs with egress network telemetry to identify redirect-driven requests to internal ranges.
- Alert on modifications to authentication configuration objects that introduce or change JWKS URLs.
- Baseline the set of remote hosts SurrealDB legitimately contacts and flag deviations.
Monitoring Recommendations
- Ingest SurrealDB server logs and network flow data into a centralized analytics platform for cross-source correlation.
- Monitor for anomalous DNS resolutions initiated by the database service account.
- Track privileged role assignments and Owner-role activity for unusual configuration changes.
How to Mitigate CVE-2026-63744
Immediate Actions Required
- Upgrade SurrealDB to version 3.1.5 or later on all instances.
- Audit existing JWKS URL configurations and remove any that reference untrusted or unnecessary external hosts.
- Review Owner-role membership and revoke privileges from accounts that do not require them.
Patch Information
SurrealDB 3.1.5 addresses the issue by revalidating redirect destinations against configured network capabilities during JWKS fetches. Refer to the GitHub Security Advisory GHSA-h5rg-8p7f-47g2 for release notes and fix commit references.
Workarounds
- Restrict egress from SurrealDB hosts at the network layer, blocking access to metadata services and internal management endpoints regardless of database-level capability settings.
- Deploy SurrealDB behind an outbound HTTP proxy that enforces host allowlisting on every redirect hop.
- Limit Owner-role assignments and require change control for any modification to authentication provider configuration.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
