CVE-2025-71398Disclosure(surrealdb / surrealdb)

LOWCVSS 7.6 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch surrealdb surrealdb systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-net restrictions by redirecting to blocked IP addresses. Attackers can host a public server that redirects to denied network targets, enabling server-side request forgery to access internal endpoints and retrieve sensitive information.

surrealdb CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

surrealdb

Threat summary

Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 2 classified signals
Peaked 2d ago at 2 mentions (2026-07-18); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

surrealdb

Products

surrealdb

Deep dive

Activity timeline4 mentions / 3d

Signal classification2 categories

Disclosure

266.7%

Patch

133.3%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-18	2	Disclosure2
2026-09-30	1	Patch1

Full discourse4 posts

DFIR Lab@DFIR_Lab18h
🚨 HIGH: CVE-2025-71398 (CVSS 7.6) SurrealDB <2.2.2 fails to validate HTTP redirects, allowing authenticated users to bypass deny-net restrictions via SSRF. Attackers can access internal endpoints & exfiltrate sensitive data. Patch immediately to v2.2.2+ #CVE #PatchNow https://t.co/8cGpH3u0Ht
0000028
150 followersView on X
DFIR Lab@DFIR_Lab19d
Patch
🚨 HIGH: CVE-2025-71398 (CVSS 7.6) affects SurrealDB <2.2.2. HTTP redirect validation flaw allows authenticated users to bypass deny-net restrictions via SSRF, exposing internal endpoints. Patch immediately. #CVE #Vulnerability #PatchNow #ThreatIntel #DFIR https://t.co/xF4NqIe66r
Post summary
The post discloses a high-severity SSRF vulnerability in SurrealDB <2.2.2 with technical details and an explicit call to patch immediately. No PoC, exploit tool, active exploitation, or false-positive claim is present.
0000024
143 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds93d
Disclosure
CVE-2025-71398 HTTP Redirect Validation Bypass in SurrealDB Before 2.2.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-71398
Post summary
A brief announcement of CVE-2025-71398, describing an HTTP redirect validation bypass in SurrealDB before 2.2.2, with only a link to a vulnerability details page and no further technical details, PoC, exploitation claims, or mitigation information.
00000100
4.1K followersView on X
CVE@CVEnew93d
Disclosure
CVE-2025-71398 SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-net restrictions by redirecting to blocked IP a… https://www.cve.org/CVERecord?id=CVE-2025-71398
Post summary
A newly identified CVE (CVE-2025-71398) indicates that SurrealDB versions earlier than 2.2.2 do not validate HTTP redirects, enabling authenticated users to bypass deny‑net restrictions by redirecting to blocked IPs.
00000699
57.8K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	surrealdb	surrealdb	-	-	-

Explore more

Back to dashboard surrealdb CVEs surrealdb vulnerabilities

What researchers are saying

CVE-2025-71398

DFIR Lab[verified]@DFIR_LabPatch

The post discloses a high-severity SSRF vulnerability in SurrealDB <2.2.2 with technical details and an explicit call to patch immediately. No PoC, exploit tool, active exploitation, or false-positive claim is present.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

A brief announcement of CVE-2025-71398, describing an HTTP redirect validation bypass in SurrealDB before 2.2.2, with only a link to a vulnerability details page and no further technical details, PoC, exploitation claims, or mitigation information.

CVE@CVEnewDisclosure

A newly identified CVE (CVE-2025-71398) indicates that SurrealDB versions earlier than 2.2.2 do not validate HTTP redirects, enabling authenticated users to bypass deny‑net restrictions by redirecting to blocked IPs.