CVE-2026-71210

Name of the Vulnerable Software and Affected Versions Mealie (affected versions not specified)

Description The AsyncSafeTransport SSRF guard in mealie/pkgs/safehttp/transport.py fails to pin the validated IP address to the actual connection. The system resolves the target hostname to check it against private-range rules but then performs the outbound HTTP request using the original hostname, causing the transport to re-resolve the address. This allows a DNS-rebinding attack, where an attacker provides a public IP during validation and a private or metadata IP during the actual connection. Authenticated users can exploit this via the endpoints '/api/recipes/create/url', '/api/recipes/test-scrape-url', and '/api/recipes/{slug}/image' to read internal HTTP services and cloud-metadata endpoints.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.