Auth bypass in Surrealdb
CVE-2025-71390
SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames against --deny-net network access restrictions in its http::* functions. An authenticated user can invoke http::<fn>(<url>) w…
Vulnerability class: Broken Access Control
Affected products
- Surrealdb — versions 0, 2.3.6, 2.2.6
Weakness classification (CWE)
References
- disclosure@vulncheck.com (vendor-advisory)
- disclosure@vulncheck.com (third-party-advisory)