CVE-2026-108594lowCWE-918

CVE-2026-108594: falha de baixa gravidade em mealie-recipes mealie

Mealie 3.26.0 through 3.28.0 SSRF via OIDC Picture Claim Avatar Fetch

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar mealie

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 2.3epss 0.2%
Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity provider hostname. Authenticated OIDC users who control their picture URL can make the server send GET requests to arbitrary ports on the provider's internal address on each login.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Produtos afetados
mealie-recipes · mealie
CVEs relacionadas — mealie-recipes mealie

No mesmo produto, das mais perigosas para as menos.

CVE-2024-31992MEDIUMMealie contains a DoS vulnerability in recipe importerEPSS 0.7%CVE-2024-31993MEDIUMMealie vulnerable to a GET-based SSRF in recipe image importer (GHSL-2023-227)EPSS 0.4%CVE-2026-93736MEDIUMMealie before 3.21.0 Information Disclosure via Ratings EndpointEPSS 0.4%CVE-2024-31991MEDIUMMealie vulnerable to a GET-based SSRF in recipe importer (GHSL-2023-225)EPSS 0.3%CVE-2024-31994MEDIUMMealie vulnerable to a DoS in recipe image importer (GHSL-2023-228)EPSS 0.3%CVE-2026-71210MEDIUMmealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal Network and Cloud Metadata AccessEPSS 0.2%