PatchSiren cyber security CVE debrief
CVE-2026-63743 surrealdb CVE debrief
CVE-2026-63743 is a capability bypass vulnerability in SurrealDB before 3.1.0. An authenticated user can exploit this vulnerability to circumvent port-scoped --deny-net rules by chaining an HTTP redirect from an allowed hostname to a denied host:port combination. The redirect is followed because the port information is dropped during redirect policy evaluation. This vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. The vulnerability exists in the HTTP redirect handling of SurrealDB, and an attacker can exploit this by creating a chain of HTTP redirects from an allowed hostname to a denied host:port combination.
- Vendor
- surrealdb
- Product
- Unknown
- CVSS
- MEDIUM 5.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-20
- Original CVE updated
- 2026-07-22
- Advisory published
- 2026-07-20
- Advisory updated
- 2026-07-22
Who should care
Users of SurrealDB before version 3.1.0 should be aware of this vulnerability and take steps to mitigate it. This includes upgrading to version 3.1.0 or later, and implementing additional security measures such as monitoring and restricting access to sensitive data. Operators, platform administrators, and security teams should review the vulnerability and take necessary actions to protect their systems.
Technical summary
The vulnerability exists in the HTTP redirect handling of SurrealDB. An attacker can exploit this by creating a chain of HTTP redirects from an allowed hostname to a denied host:port combination. The port information is dropped during redirect policy evaluation, allowing the redirect to be followed. This can be used to bypass port-scoped --deny-net rules, potentially allowing an attacker to access sensitive data or perform unauthorized actions. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM.
Defensive priority
Medium
Recommended defensive actions
- Upgrade to SurrealDB version 3.1.0 or later
- Implement monitoring and logging to detect potential exploitation attempts
- Restrict access to sensitive data and functionality
- Review and update --deny-net rules to ensure they are effective
- Review compensating controls for exposed systems while remediation is scheduled and verified
- Check relevant monitoring, detection, and logs for exposed assets that need extra review
- Track exceptions, retest remediated assets, and close the item only after evidence is documented
Evidence notes
The CVE record was published on 2026-07-20T12:19:43.713Z and was last modified on 2026-07-21T18:37:56.803Z. The NVD entry is currently Awaiting Analysis. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the vendor. The CVE record does not provide detailed information about the vulnerability, so defenders should be cautious and monitor for potential exploitation attempts.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-20T12:19:43.713Z and has not been modified since then. The NVD entry is currently Awaiting Analysis.