CVE-2026-121420
Low · 3.3CVSS
3.3
EPSS
0.2%
Published
Nov 3, 2026
CISA due date
—
The record
SurrealDB from 3.2.0 before 3.3.0 contains a server-side request forgery vulnerability in the FilteringResolver is_private_ip check that fails to unwrap NAT64, 6to4, and Teredo IPv6 addresses. Authenticated users triggering outbound HTTP requests via SurrealQL http functions can use transition addresses embedding private IPv4 targets to reach localhost, internal services, or cloud metadata endpoints.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121581 A vulnerability has been found in ArcReel 0.32.0/0.33.0/0.34.0. CWE-918
- CVE-2026-121580 Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server… CWE-918
- CVE-2026-120715 Server-side request forgery in the Active Directory credential validation in Devolutions… CWE-918
- CVE-2026-105822 The Tapo Cloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability… CWE-918
- CVE-2026-121561 Label Studio before 1.23.2 (label-studio-sdk before 2.1.2) contains a server-side request… CWE-918
- CVE-2026-114582 An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before… CWE-918
- CVE-2026-111362 An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before… CWE-918
- CVE-2026-121431 AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows… CWE-918