LOWCVSS v3.1 3.3Vulnerability
CVE-2026-121420
SurrealDB from 3.2.0 before 3.3.0 contains a server-side request forgery vulnerability in the FilteringResolver is_private_ip check that fails to unwrap NAT64, 6to4, and Teredo IPv6 addresses. Authenticated users triggering outbound HTTP requests via SurrealQL http functions can use transition addresses embedding private IPv4 targets to reach localhost, internal services, or cloud metadata endpoints.
Properties
- Severity
- LOW
- Nvd fetched at
- 2026-11-03T17:20:13.885968+00:00
- Cvss severity
- LOW
- Cvss score
- 3.3
- Retrieved at
- 2026-11-03T17:21:18+00:00
- Score
- 3.3
- Cvss version
- 3.1
- Last source
- NVD
- Cve id
- CVE-2026-121420
- Cvss vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- First seen by Signal
- 2026-11-03T17:21:18+00:00
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Published at
- 2026-11-03T15:17:32.160
- Last modified
- 2026-11-03T15:17:32.290
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph