Server-Side Request Forgery in Mealie Recipe Actions

Executive Summary

CVE-2026-94028 is a Server-Side Request Forgery (SSRF) vulnerability in Mealie up to version 3.25.1. It allows authenticated users to trigger recipe actions with arbitrary URLs, causing the server to make POST requests to those URLs without proper SSRF protections. The vulnerability bypasses existing security measures that block requests to private or reserved IP ranges.

Useful 0 Not Useful 0

Detection Guidance

To detect this SSRF vulnerability in Mealie, monitor network traffic for unauthorized outbound requests from the Mealie server to internal or private IP ranges. Check logs for recipe actions or webhooks triggering POST requests to unexpected URLs. Use network scanning tools like nmap to identify if Mealie is making requests to internal services or cloud metadata endpoints (e.g., 169.254.169.254 for AWS).

Commands to check for suspicious activity: 1) Inspect Mealie logs for outgoing HTTP requests: grep -r 'POST' /var/log/mealie/ or docker logs <mealie-container>. 2) Use tcpdump or Wireshark to capture outbound traffic from the Mealie server: tcpdump -i any host <mealie-server-ip> and port 80 or 443. 3) Check for DNS rebinding attempts by analyzing DNS logs for repeated resolutions of the same domain to different IPs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to access internal services, retrieve cloud metadata like AWS IMDS credentials, or interact with private network hosts. The impact is severe in cloud deployments where metadata endpoints return sensitive credentials. The exploit requires only authenticated user access, not admin privileges.

Useful 0 Not Useful 0

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to internal services or cloud metadata endpoints, potentially exposing sensitive data such as IAM credentials. For GDPR, this may violate data protection principles by enabling unauthorized data access. For HIPAA, it could risk exposing protected health information if internal systems are compromised.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Mealie to version 3.26.0 or later to apply the SSRF protection patch. This version includes stricter validation for outgoing requests and blocks access to private/internal networks by default.

If upgrading is not immediately possible, restrict network access to the Mealie server by configuring a firewall to block outbound requests to private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16). Disable or audit any existing recipe actions or webhooks that allow arbitrary URLs.

Review and update environment variables to explicitly allow only trusted internal hosts if necessary: set HTTP_ALLOW_LIST to permit specific internal services and HTTP_DISALLOW_LIST to block known risky ranges. Monitor logs for blocked requests and investigate any anomalies.

Useful 0 Not Useful 0