SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect (CVE-2026-63743)

SurrealDB's network access control uses --allow-net and --deny-net capabilities to restrict external HTTP requests. When a port-specific deny rule is set (e.g., --deny-net <host>:<port>), an authenticated user can bypass it by triggering an HTTP redirect from an allowed host to the denied host:port. The root cause is that the redirect policy constructs the network target without the port, causing the capability matcher to fail to apply the port-specific deny rule. This leads to silent bypass of port-scoped deny rules on redirect targets. The vulnerability affects versions prior to 3.1.0. The fix involves including the port in the NetTarget for redirect URLs, ensuring deny rules apply correctly to redirects. Additional mitigations include using host-only deny rules or disabling http::* functions for untrusted users.

This vulnerability allows authenticated users with http::* function permissions to circumvent port-specific network deny rules by leveraging HTTP redirects. This can lead to unauthorized access to internal or otherwise restricted services running on specific ports, such as local Redis instances or cloud metadata services. The impact depends on the deployment and the specific deny rules configured. Host-only deny rules are not affected. There is no indication of known exploits in the wild.

A patch is available and included starting with SurrealDB version 3.1.0, which fixes the redirect handling to respect port-specific deny rules. Operators should upgrade to version 3.1.0 or later. Workarounds include replacing port-specific deny rules with host-only deny rules where feasible, disabling http::* functions for untrusted principals, or terminating outbound HTTP requests at a reverse proxy that enforces port-specific access controls. These mitigations reduce the risk until the patch is applied.