Is CVE-2026-121422 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-121422?

CVE-2026-121422 has a CVSS v3 severity of MEDIUM (4.1).

Back

CVE-2026-121422

Description

SurrealDB from 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability that allows database Owners to bypass port-specific deny-net rules by using JWKS URLs with implicit default ports. Attackers can configure a JWT or record access method whose JWKS URL omits port 80 or 443, causing blind GET requests to explicitly denied internal services.