SurrealDB before version 3.1.0 contains a flaw in its HTTP redirect handling that allows an authenticated user to bypass port‑scoped "--deny-net" rules. The server discards the destination port when evaluating a redirect, so a chain from an allowed hostname to a denied host:port pair is accepted and followed. This gives the attacker access to services that should have been blocked by the deny rule, effectively granting unauthorized network access to restricted endpoints.

The vulnerability impacts all installations of SurrealDB released prior to version 3.1.0. Any deployment that has not applied the 3.1.0 patch and that allows authenticated users to receive HTTP redirects is potentially vulnerable.

The CVSS score of 5.3 indicates a medium severity. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, implying that widespread exploitation is unlikely but not impossible. An attacker must have valid credentials to exploit the flaw, then craft a redirect request from an allowed host to a denied host:port pair. Because the redirect is automatically followed by the server, the deny rule is effectively bypassed. The risk is moderate, but a compromised internal account could use this mechanism to reach otherwise protected endpoints.