CVE-2025-71390

Katalog CVE

CVSS 8.8 · High EPSS 0,25%

Kerentanan Incorrect Authorization pada surrealdb. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames against --deny-net network access restrictions in its http::* functions. An authenticated user can invoke http::<fn>(<url>) with a hostname that resolves to a denied IP address, causing the server to issue the request anyway and return the response. This bypasses network access controls, allowing access to restricted internal endpoints and potentially retrieving or altering sensitive information and credentials, depending on the deployment.

Rincian

Terbit di NVD

18 Juli 2026

Terakhir diubah

29 September 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 14,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m3c3-78fh-w3w7 advisory vendor
• https://www.vulncheck.com/advisories/surrealdb-before-deny-net-bypass-via-dns-resolution advisory pihak ketiga