CVE-2025-71398

SurrealDB before 2.2.2 SSRF via HTTP Redirect Bypass

State: Published
Severity: 5.8 Medium
Published: Jul 18, 2026
Updated: Oct 29, 2026
Reserved: Jul 18, 2026

Description

SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-net restrictions by redirecting to blocked IP addresses. Attackers can host a public server that redirects to denied network targets, enabling server-side request forgery to access internal endpoints and retrieve sensitive information.

Scores

CVSS	Score	Vector	Source
4.0	5.8 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H	VulnCheck

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Product	Versions
surrealdbsurrealdb	2.2.0 to before 2.2.2Affected 2.2.2Not affected
surrealdbsurrealdb	2.1.0 to before 2.1.5Affected 2.1.5Not affected
surrealdbsurrealdb	before 2.0.5Affected 2.0.5Not affected

References

GitHub Security Advisory (GHSA-5q9x-554g-9jgg)vendor-advisory
VulnCheck Advisory: SurrealDB before 2.2.2 SSRF via HTTP Redirect Bypassthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.