CVE-2026-71210
Received Received - Intake

Mealie AsyncSafeTransport SSRF via DNS Rebinding

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
Mealie's AsyncSafeTransport SSRF guard (mealie/pkgs/safehttp/transport.py) resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independently. Because the validated IP is never pinned to the actual connection, a DNS-rebinding attacker (returning a public IP to the validation lookup and a private/metadata IP to the real connection) defeats the guard. This is reachable by any authenticated user via /api/recipes/create/url, /api/recipes/test-scrape-url, and /api/recipes/{slug}/image, and the scraper reflects fetched content back to the requester, allowing an authenticated user to read internal HTTP services and cloud-metadata endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71210
EUVD
EUVD-2026-53207

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
mealie asyncsafetransport *
mealie mealie *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves Server-Side Request Forgery (SSRF) in Mealie's AsyncSafeTransport. The system validates a hostname's IP address against private ranges but then uses the original hostname for the actual HTTP request. An attacker can exploit DNS rebinding, where the hostname resolves to a public IP during validation but a private or metadata IP during the real connection, bypassing security checks. This allows reading internal services and cloud metadata.

Detection Guidance

Check Mealie logs for outbound HTTP requests to unexpected internal or metadata IP addresses. Monitor DNS queries for domains resolving to both public and private IPs in quick succession. Use tools like tcpdump or Wireshark to inspect traffic from Mealie instances for SSRF patterns.

Impact Analysis

An authenticated user could exploit this to access internal HTTP services or cloud metadata endpoints within your network. The attacker can read sensitive data from these services, potentially leading to unauthorized information disclosure or further attacks on internal systems.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information. Organizations may face compliance breaches, legal penalties, or reputational damage if exploited.

Mitigation Strategies

Update Mealie to the latest patched version. Disable the affected endpoints (/api/recipes/create/url, /api/recipes/test-scrape-url, /api/recipes/{slug}/image) if not needed. Restrict network access to Mealie to prevent unauthorized outbound requests. Review and audit user permissions to ensure only trusted users can access these endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71210. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart