CVE-2026-121422
MEDIUM
NVD
CVSS Score
4.1
Severity
MEDIUM
Published
Nov 03, 2026
Vendor
unknown
Description
SurrealDB from 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability that allows database Owners to bypass port-specific deny-net rules by using JWKS URLs with implicit default ports. Attackers can configure a JWT or record access method whose JWKS URL omits port 80 or 443, causing blind GET requests to explicitly denied internal services.