Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-63736— SurrealDB before 3.2.0 SSRF via JWKS URL hostname resolution

Quick assessment

Affected

surrealdb surrealdb

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

surrealdb是SurrealDB公司开源的一个文档图数据库。 SurrealDB 3.2.0之前版本存在服务端请求伪造漏洞，该漏洞源于JWKS fetcher仅验证URL主机名字符串，未检查解析的IP地址，可能导致具有Owner角色的攻击者指向允许列表中的主机名解析到私有或回环地址，致使服务器向内部地址发出GET请求。

CVSS 4.1 · Medium EPSS 0.31% · P24 Updated Jul 28, 2026

Possible ATT&CK Techniques 1 AI

T1557 · Adversary-in-the-Middle

Affected Version Matrix 2

Vendor	Product	Version Range	Status
surrealdb	surrealdb	`< 3.2.0`	affected
		`3.2.0`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-63736

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

SurrealDB before 3.2.0 SSRF via JWKS URL hostname resolution

Source: CVE Program / CVE List V5

Vulnerability Description

SurrealDB before 3.2.0 contains a server-side request forgery vulnerability in the JWKS fetcher that validates only the URL hostname string against allow-lists without checking resolved IP addresses. An Owner role attacker can point an access method at an allow-listed hostname resolving to private or loopback addresses, causing the server to issue GET requests to internal addresses that would be blocked by direct URL.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

服务端请求伪造(SSRF)

Source: CVE Program / CVE List V5

Vulnerability Title

SurrealDB 服务端请求伪造漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
surrealdb	surrealdb	0 ~ 3.2.0	-

II. Public POCs for CVE-2026-63736

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-63736

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-63736 (2)

🔗 SSRF via JWKS URL — allow-listed hostname resolving to a private IP · Advisory · surrealdb/surrealdb · GitHub Read full article vendor-advisory
🔗 SurrealDB before 3.2.0 SSRF via JWKS URL hostname resolution | Advisories | VulnCheck third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-63736

Same Patch Batch · surrealdb · 2026-07-20 · 31 CVEs total

CVE-2026-63757	8.8 HIGH	SurrealDB before 3.1.0 Session Hijacking via /rpc sessions
CVE-2026-63756	8.1 HIGH	SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition
CVE-2026-63735	8.1 HIGH	SurrealDB before 3.2.0 Authentication Bypass via Custom API
CVE-2026-63739	7.7 HIGH	SurrealDB before 3.1.5 Arbitrary File Read via DEFINE ANALYZER
CVE-2026-63747	7.5 HIGH	SurrealDB before 3.1.0 Denial of Service via malformed RPC use
CVE-2026-63760	7.5 HIGH	SurrealDB before 3.1.0 Denial of Service via JSON Parser
CVE-2026-63763	7.5 HIGH	SurrealDB before 2.5.0 Privilege Escalation via Future Fields
CVE-2026-63746	6.5 MEDIUM	SurrealDB before 3.1.0 Permission Bypass via Graph Traversal
CVE-2026-63754	6.5 MEDIUM	SurrealDB before 3.1.0 Denial of Service via LIVE Query
CVE-2026-63737	6.5 MEDIUM	SurrealDB before 3.1.5 Denial of Service via deep operator chains
CVE-2026-63741	6.5 MEDIUM	SurrealDB before 3.1.0 Authentication Bypass via USE statement
CVE-2026-63740	6.5 MEDIUM	SurrealDB before 3.1.4 Array Element Permission Bypass
CVE-2026-63755	6.5 MEDIUM	SurrealDB before 3.1.0 Permission Bypass via WHERE Clause
CVE-2026-63759	6.5 MEDIUM	SurrealDB before 3.1.0 Denial of Service nested type annotations
CVE-2026-63743	6.4 MEDIUM	SurrealDB before 3.1.0 Port-Specific Deny Rule Bypass via HTTP Redirect
CVE-2026-63762	6.0 MEDIUM	SurrealDB before v2.6.1 Denial of Service via scripting
CVE-2026-63758	5.4 MEDIUM	SurrealDB before 3.1.0 Authorization Bypass via KILL Statement
CVE-2026-63745	5.4 MEDIUM	SurrealDB before 3.1.0 Authorization Bypass via Composite Record-id
CVE-2026-63750	5.3 MEDIUM	SurrealDB before 3.1.0 Memory Amplification via /sql WebSocket
CVE-2026-63734	4.9 MEDIUM	SurrealDB before 3.2.0 Denial of Service via malformed SurrealML import

Showing top 20 of 31 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: surrealdb

Same vendor: surrealdb

Same weakness: CWE-918