SurrealDB versions prior to 3.2.0 contain a server‑side request forgery flaw in the JWKS fetcher module. The implementation validates only the hostname string of the URL against an allow‑list, but it does not verify the resolved IP address. An attacker who can assume an Owner role can therefore direct the system to fetch a JWKS document from an allow‑listed hostname that resolves to a private or loopback IP. This causes the SurrealDB server to send a GET request to an internal address that would normally be blocked by direct URL restrictions, potentially exposing internal resources or enabling further lateral movement.

All installations of SurrealDB versions prior to 3.2.0 are affected. The vulnerability is present in the surrealdb:surrealdb product line as identified by the CNA.

The CVSS score of 5.1 indicates a moderate severity. EPSS score is 0.00226, indicating a very low exploitation probability, and the vulnerability is not catalogued in CISA’s KEV database. The exploit relies on an Owner‑level attacker who can control the JWKS URL. Because the vulnerability allows internal network requests, it can be used to discover or access services on the same host or internally networked systems. The lack of publicly known exploits does not eliminate the risk; the flaw remains exploitable as soon as an authorized operator can supply a manipulated JWKS URL.