CVE-2026-121422 — Vulnerability intelligence
—
Published:
- CVSS
- 5.1
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
SurrealDB from 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability that allows database Owners to bypass port-specific deny-net rules by using JWKS URLs with implicit default ports. Attackers can configure a JWT or record access method whose JWKS URL omits port 80 or 443, causing blind GET requests to explicitly denied internal services.