CVE-2025-71398 SurrealDB before 2.2.2 SSRF via HTTP Redirect Bypass

What is CVE-2025-71398?

CVE-2025-71398 is a medium-severity server-side request forgery vulnerability in Surrealdb Surrealdb, published on 18 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-net restrictions by redirecting to blocked IP addresses. Attackers can host a public server that redirects to denied network targets, enabling server-side request forgery to access internal endpoints and retrieve sensitive information.

Weakness: CWE-918

Which versions are affected by CVE-2025-71398?

6 open source packages ship an affected version, including surrealdb. It affects 1 product.

Products include Surrealdb Surrealdb.

How do I fix CVE-2025-71398?

Upgrade surrealdb to a fixed version for your release line: 2.0.5, 2.1.5 or 2.2.2.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2025-71398 being exploited?

There is no known exploitation of CVE-2025-71398 in the wild and no public exploit code.

Other vulnerabilities in Surrealdb Surrealdb

• CVE-2025-71392 SurrealDB before 2.2.2 SurrealQL Injection via export Critical 9.4
• CVE-2026-63756 SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition Critical 9.2
• CVE-2026-63747 SurrealDB before 3.1.0 Denial of Service via malformed RPC use High 8.7
• CVE-2026-63757 SurrealDB before 3.1.0 Session Hijacking via /rpc sessions High 8.7
• CVE-2026-63760 SurrealDB before 3.1.0 Denial of Service via JSON Parser High 8.7

All Surrealdb Surrealdb vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5q9x-554g-9jgg.