Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-71398: SurrealDB lets authenticated users reach blocked internal servers

CVE-2025-71398 · published 3 months ago

Summary

Versions of SurrealDB before 2.2.2 do not check where HTTP redirects point. A user who can run database queries could cause the server to follow a redirect to a private IP address, letting them view internal services or data. Upgrade SurrealDB to version 2.2.2 or later and consider disabling or limiting redirect functionality for untrusted users.

What to do

Update tobiemh surrealdb to version 2.2.2.
Update tobiemh surrealdb to version 2.1.5.
Update tobiemh surrealdb to version 2.0.5.
Update surrealdb to version 2.2.2.
Update surrealdb to version 2.1.5.
Update surrealdb to version 2.0.5.

Affected software

Ecosystem	Vendor	Product	Affected versions
rust	tobiemh	surrealdb	>= 2.2.0, < 2.2.2 >= 2.1.0, < 2.1.5 < 2.0.5 Fix: upgrade to 2.2.2
–	surrealdb	surrealdb	< 2.2.2 < 2.1.5 < 2.0.5 `cpe:2.3:a:surrealdb:surrealdb::::::::`
rust	–	surrealdb	>= 2.2.0, < 2.2.2 >= 2.1.0, < 2.1.5 < 2.0.5 Fix: upgrade to 2.2.2

Original advisory text

SurrealDB before 2.2.2 SSRF via HTTP Redirect Bypass

SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-net restrictions by redirecting to blocked IP addresses. Attackers can host a public server that redirects to denied network targets, enabling server-side request forgery to access internal endpoints and retrieve sensitive information.

References

https://github.com/surrealdb/surrealdb/pull/5597
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-5q9x-554g-9jgg Vendor Advisory
https://github.com/advisories/GHSA-5q9x-554g-9jgg
https://github.com/surrealdb/surrealdb Product
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71398... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-71398 Vendor Advisory
https://www.vulncheck.com/advisories/surrealdb-before-ssrf-via-http-redirect-byp... Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.6 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-918Server-Side Request Forgery (SSRF)

Timeline

Published18 Jul 2026

Updated4 Nov 2026

First seen6 Mar 2026

Sources

CVE-2025-71398 · NVD

GHSA-5q9x-554g-9jgg · GHSA

CVE-2025-71398 · OSV

GHSA-5q9x-554g-9jgg · OSV

CVE-2025-71398 · MITRE

Track software like this

Free during beta