SurrealDB before 2.2.2 does not validate HTTP redirects in its http functions, enabling an attacker who already has authenticated access to redirect the server to a blocked IP address. This subverts deny‑net restrictions and produces a server‑side request forgery. The attacker can then access internal endpoints and read sensitive data, reflecting a medium‑severity vulnerability classified as CWE‑918.

All installations of SurrealDB earlier than version 2.2.2 are vulnerable. The flaw affects any instance that uses the http function to contact external services. No additional configuration information is supplied. The vendor is SurrealDB.

The CVSS score of 5.8 suggests medium overall severity. The EPSS score of less than 1% indicates that current exploitation likelihood is low, and the flaw is not listed in the CISA KEV catalog. Exploitation requires authenticated access and the ability to trigger an http function; once a redirect to a private network target is delivered, the SurrealDB server will perform a request to that target, enabling data exfiltration. Attackers would need to host a publicly reachable server that issues the redirect.