CVE-2026-121422

MediumCVSS 4.1/10Last modified Nov 7, 2026

Description

SurrealDB from 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability that allows database Owners to bypass port-specific deny-net rules by using JWKS URLs with implicit default ports. Attackers can configure a JWT or record access method whose JWKS URL omits port 80 or 443, causing blind GET requests to explicitly denied internal services.

Metrics

CVSS 3.1 4.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
surrealdb	surrealdb	>= 3.1.0, < 3.3.0

References

Timeline

Published: Nov 3, 2026
Last modified: Nov 7, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1214236.5SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by trigge CVE-2026-1214246.5Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect reci CVE-2026-1214256.5Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted displa CVE-2026-1214266.5Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '>' inside a quo CVE-2026-1214277.5AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking the Manage statio CVE-2026-1214288.8AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor conf CVE-2026-1214298.8AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commands CVE-2026-121437.5form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#appen CVE-2026-1214305.4AzuraCast before 0.24.0 contains a missing authorization vulnerability in the GET and POST /api/station/{station_id}/waveform/{media_id} rou CVE-2026-1214315.3AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks permission to bypass th CVE-2026-1214323.5AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedd CVE-2026-1214335.4AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist for