Description
SurrealDB before 3.1.5 contains a server-side request forgery vulnerability in the JWKS fetcher that follows HTTP redirects without re-validating redirect targets against network capabilities. Attackers with Owner role can configure a JWKS URL pointing to an allowlisted host that redirects to blocked internal addresses, bypassing network access controls.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| surrealdb | surrealdb | < 3.1.5 | 3.1.5 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | surrealdb | < 3.1.5 | 3.1.5 | GHSA-h5rg-8p7f-47g2 |
References
- GitHub Security Advisory (GHSA-h5rg-8p7f-47g2) vendor-advisory
- VulnCheck Advisory: SurrealDB before 3.1.5 SSRF via JWKS URL Redirect third-party-advisory