SurrealDB before versions 2.2.6, 2.3.6, 2.1.8, and 3.0.0-alpha.7 and earlier fails to validate DNS-resolved hostnames against the --deny-net network access restrictions in its http::* functions. An authenticated user can exploit this by invoking http::<fn>(<url>) with a hostname that resolves to an IP address within a denied network range. The server issues the request regardless of the deny-net restrictions and returns the response, effectively bypassing network access controls. This can lead to unauthorized access to internal endpoints and may result in retrieval or alteration of sensitive data and credentials depending on the deployment environment.

The vulnerability allows authenticated users to bypass network access restrictions configured via --deny-net, enabling them to access internal or restricted network resources that should be blocked. This can lead to unauthorized disclosure or modification of sensitive information and credentials, posing a significant security risk to affected deployments.

No official patch links are provided in the data, and patch status is not explicitly confirmed. Therefore, patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions to trusted users only and monitor usage of http::* functions to detect potential abuse.