CVE-2026-63736 surrealdb CVE debrief

Who should care

Users of SurrealDB before version 3.2.0 should be aware of this vulnerability and take steps to mitigate it. This includes upgrading to version 3.2.0 or later, and implementing additional security measures such as validating resolved IP addresses. Operators, platform administrators, and security teams should review the vulnerability's impact on their systems and prioritize mitigation efforts.

Technical summary

The vulnerability exists in the JWKS fetcher of SurrealDB before 3.2.0, which validates only the URL hostname string against allow-lists without checking resolved IP addresses. An attacker with the Owner role can exploit this vulnerability by pointing an access method at an allow-listed hostname resolving to private or loopback addresses, causing the server to issue GET requests to internal addresses that would be blocked by direct URL. This can lead to unauthorized requests and potential security breaches. Users should be aware of this vulnerability and take steps to mitigate it.

Defensive priority

Medium

Recommended defensive actions

• Upgrade to SurrealDB version 3.2.0 or later
• Implement additional security measures such as validating resolved IP addresses
• Monitor for suspicious activity and implement compensating controls
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-20T12:19:42.707Z and last modified on 2026-07-21T18:37:56.803Z. The NVD entry is currently Awaiting Analysis. Evidence is limited, and defenders should verify the vulnerability's impact on their systems. The vulnerability exists in the JWKS fetcher of SurrealDB, which does not properly validate the resolved IP addresses of allow-listed hostnames. This limited information is based on the CVE record and NVD entry.

Official resources