The vulnerability in SurrealDB (CVE-2025-71390) arises from improper validation of DNS-resolved hostnames against the --deny-net network access restrictions in its HTTP functions. Authenticated users can exploit this by supplying a hostname that resolves to an IP address within a denied network range, bypassing the intended network access controls. This results in the server issuing HTTP requests to restricted internal endpoints, potentially exposing or altering sensitive data depending on the deployment context. The affected versions include all releases before 2.2.6, 2.3.6, and 2.1.8, as well as 3.0.0-alpha.7 and earlier.

An authenticated user can bypass network access restrictions configured in SurrealDB's HTTP functions, allowing unauthorized requests to internal or restricted network endpoints. This can lead to exposure or modification of sensitive information and credentials within the affected environment. The severity is considered moderate based on the potential for unauthorized internal network access and data compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions to limit access to HTTP functions or restrict network access at the infrastructure level to mitigate potential exploitation.