CVE-2026-108594lowCWE-918

CVE-2026-108594: low-severity vulnerability in mealie-recipes mealie

Mealie 3.26.0 through 3.28.0 SSRF via OIDC Picture Claim Avatar Fetch

Published · Updated

Follow this CVE+ Monitor mealie

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 2.3epss 0.2%
Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity provider hostname. Authenticated OIDC users who control their picture URL can make the server send GET requests to arbitrary ports on the provider's internal address on each login.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Affected products
mealie-recipes · mealie
Related CVEs — mealie-recipes mealie

In the same product, most dangerous first.

CVE-2024-31992MEDIUMMealie contains a DoS vulnerability in recipe importerEPSS 0.7%CVE-2024-31993MEDIUMMealie vulnerable to a GET-based SSRF in recipe image importer (GHSL-2023-227)EPSS 0.4%CVE-2026-93736MEDIUMMealie before 3.21.0 Information Disclosure via Ratings EndpointEPSS 0.4%CVE-2024-31991MEDIUMMealie vulnerable to a GET-based SSRF in recipe importer (GHSL-2023-225)EPSS 0.3%CVE-2024-31994MEDIUMMealie vulnerable to a DoS in recipe image importer (GHSL-2023-228)EPSS 0.3%CVE-2026-71210MEDIUMmealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal Network and Cloud Metadata AccessEPSS 0.2%