Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-63743

SurrealDB before 3.1.0 contains a capability bypass vulnerability in HTTP redirect handling that allows authenticated users to circumvent port-scoped --deny-net rules. Attackers can chain an HTTP redirect from an allowed hostname to a denied host:port combination, and the redirect is followed because the port information is dropped during redirect policy evaluation.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 8.8%
CVSS Severity
CVSS v3 Score 6.4
Products affected by CVE-2026-63743


Contact Us

Shodan ® - All rights reserved