GHSA-xhwm-9486-8rgr

Duplicate Advisory: SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF)

Published

2026-07-18

Modified

2026-09-04

Sources

github-advisory

Summary

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5q9x-554g-9jgg. This link is maintained to preserve external references. ## Original Description SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-net restrictions by redirecting to blocked IP addresses. Attackers can host a public server that redirects to denied network targets, enabling server-side request forgery to access internal endpoints and retrieve sensitive information.

Affected packages

Remediation: No patched version is listed by GitHub.

References

• https://github.com/advisories/GHSA-xhwm-9486-8rgr