SSRF Vulnerability in Mealie Recipe Management Software
CVE-2026-71210

6.5MEDIUM

Key Information:

Vendor

Mealie-recipes

Status
Mealie
Vendor
CVE Published:
5 August 2026

What is CVE-2026-71210?

The SSRF vulnerability in Mealie's AsyncSafeTransport arises from improper hostname resolution handling. When a target hostname is resolved, the system checks the resultant IP against private-range rules but fails to bind the validated IP to the actual outbound HTTP request. Instead, the async transport may re-resolve the hostname independently, creating a risk where a DNS-rebinding attacker can exploit this flaw. An attacker can manipulate the resolved IP address during validation, ultimately allowing unauthorized access to internal HTTP services and sensitive cloud-metadata endpoints via accessible API routes. This vulnerability can be exploited by any authenticated user with access to the affected API endpoints.

Affected Version(s)

mealie 0

References

https://github.com/mealie-recipes/mealie

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sarvar Omonov
.