{"id":"CVE-2026-63743","aliases":["GHSA-97vg-427p-8hx5"],"title":"SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect","summary":"SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect","severity":"medium","cvss":6.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","vendor":"surrealdb","product":"surrealdb","ecosystem":"rust","affected":["surrealdb < 3.1.0"],"patched":["surrealdb 3.1.0"],"published":"2026-07-01","updated":"2026-09-04","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-97vg-427p-8hx5","references":[{"url":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-97vg-427p-8hx5"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63743"},{"url":"https://github.com/surrealdb/surrealdb/commit/https://github.com/surrealdb/surrealdb/commit/ceb1ca3a1"},{"url":"https://github.com/surrealdb/surrealdb"},{"url":"https://www.vulncheck.com/advisories/surrealdb-before-port-specific-deny-rule-bypass-via-http-redirect"}],"tags":["osv","rust"],"epss":0.00249,"epssPercentile":0.14428,"ingestedAt":"2026-09-05T19:33:49.777Z","slug":"CVE-2026-63743","body":"## Overview\n\nSurrealDB offers `http::*` functions that can access external network endpoints, with the `--allow-net` and `--deny-net` capabilities used to restrict the set of network targets that can be reached. An authenticated user of SurrealDB can bypass a port-scoped `--deny-net <host>:<port>` rule by chaining an HTTP redirect: the initial request goes to an `--allow-net`-permitted hostname, the response's `3xx Location` header points at the denied `host:port`, and the redirect is followed even though the destination was explicitly denied.\n\nThe root cause is in the redirect policy applied to outbound HTTP requests (`surrealdb/core/src/fnc/util/http/mod.rs`): the `NetTarget` for the redirect destination is built from `url.host_str()` alone and `url.port()` is dropped. The capability matcher (`surrealdb/core/src/dbs/capabilities.rs:259-264`) refuses to match a port-bearing rule against a port-stripped target (`Self::Host(host, Some(port)) => match tgt { _ => false }`), so the operator's port-scoped deny rule silently does not fire on the redirect target.\n\n### Impact\n\nThe impact of this vulnerability is circumvention of the `--deny-net` capability when the operator has scoped deny rules by port, and the resulting impact on systems external to SurrealDB. The ultimate impact is dependent on the deployment scenario.\n\nFor example, if a SurrealDB operator uses `--deny-net <host>:<port>` to block specific internal services (such as a local Redis at `192.168.1.1:6379` or an unauthenticated cloud metadata service) while leaving the rest of the host reachable, an authenticated principal that can call `http::*` and host an attacker-controlled redirect target can reach the blocked service and act on whatever interface it exposes.\n\nBounded to:\n\n- Principals already permitted to call `http::*`.\n- Capability configurations that scope deny rules by port. Host-only rules (`--deny-net <host>`) are not affected because the host-only rule arm of the matcher accepts port-stripped targets.\n\n### Patches\n\nThe redirect policy now constructs the `NetTarget` for the redirect URL with `url.port()` included, so port-specific deny rules apply to redirect targets identically to initial requests.\n\nA new integration regression test (`function_http_redirect_to_denied_port_blocked`) uses two wiremock servers to verify the redirect target is blocked and the denied server receives no requests.\n\nVersions 3.1.0 and later are not affected.\n\n### Workarounds\n\n- Replace port-specific deny rules with host-only deny rules where feasible (`--deny-net 192.168.1.1` instead of `--deny-net 192.168.1.1:6379`). Host-only rules match port-stripped targets, at the cost of denying every port on that host.\n- Disable `http::*` for untrusted principals (`--deny-funcs 'http::*'`) where the functions are not required.\n- Terminate outbound HTTP requests at a reverse proxy that enforces port-specific access controls.\n\n## Affected packages\n\n- `surrealdb < 3.1.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `surrealdb 3.1.0`","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":35.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}