CVE-2026-108594 in Mealie
Summary
by MITRE • 10/10/2026
Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity provider hostname. Authenticated OIDC users who control their picture URL can make the server send GET requests to arbitrary ports on the provider's internal address on each login.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/10/2026
The identified vulnerability resides within Mealie versions 3.26.0 through 3.28.0 and specifically affects the OpenID Connect avatar fetch mechanism. This flaw constitutes a Server-Side Request Forgery, commonly abbreviated as SSRF, which allows an attacker to induce the server-side application to make HTTP requests to arbitrary destinations that would otherwise be inaccessible from the external network. The root cause of this vulnerability is a logic error in the hostname validation routine used during the identity provider authentication process. Specifically, when Mealie verifies whether the OpenID Connect provider's hostname matches an allowlisted domain, it fails to account for port numbers embedded within the URL structure. This oversight means that if an attacker controls their picture URL or can manipulate the OIDC configuration associated with their account, they can bypass the intended host-based restrictions by appending a specific internal port number to the allowed hostname.
From a technical perspective, this vulnerability exploits how web servers and identity providers parse Uniform Resource Locators. When a user authenticates via OpenID Connect, Mealey retrieves profile information, including an avatar image URL, from the provider's userinfo endpoint or associated metadata. The application performs a security check to ensure that the hostname of this resource matches one of the pre-approved domains configured by the system administrator. However, because the validation logic does not strip or ignore port identifiers before comparison, it treats hostnames with different ports as distinct entities only if they are explicitly listed separately in the allowlist. Consequently, an attacker can specify a target such as allowed-domain.com:8080 and pass this check against an entry for allowed-domain.com on the default HTTP port 80 or HTTPS port 443. This allows the server to initiate connections to internal services running on non-standard ports within the identity provider's network infrastructure, effectively bypassing perimeter security controls that rely solely on hostname filtering.
The operational impact of this vulnerability is significant for organizations relying on Mealey as their recipe management and authentication platform. Since the flaw requires an authenticated user who can control their picture URL or OIDC profile data to exploit it, the threat actor must first gain valid access credentials. Once authenticated, the attacker can leverage SSRF capabilities to probe internal networks associated with the identity provider. This may lead to unauthorized access to sensitive internal services such as administrative dashboards, database interfaces, or other microservices that are not exposed to the public internet but are accessible within the same network segment or virtual private cloud environment. The ability to target arbitrary ports expands the attack surface considerably, potentially allowing attackers to discover and interact with vulnerable backend systems, exfiltrate data from internal APIs, or use Mealey as a pivot point for further lateral movement within the organization's infrastructure.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-918, which describes Server-Side Request Forgery (SSRF) flaws where server-side code makes requests to user-supplied URLs without proper validation of the destination host or port. Additionally, in terms of tactical classification under the MITRE ATT&CK framework, this behavior corresponds to T1560.002, Data Staged via Archive Utility, if used for data exfiltration, but more accurately fits within Reconnaissance techniques such as T1046 Network Service Discovery or T1078 Valid Accounts when considering the initial access requirement. The exploitation vector is primarily remote and requires low complexity once authentication is achieved, making it a high-risk issue that demands immediate attention from security operations teams.
To mitigate this vulnerability, administrators of Mealey instances running versions 3.26.0 through 3.28.0 should upgrade to the latest patched version where the hostname validation logic has been corrected to strictly enforce port-agnostic matching or explicitly reject URLs containing non-standard ports unless they are part of a comprehensive allowlist that includes specific port definitions. In environments where upgrading is not immediately feasible, network-level controls such as firewall rules can be implemented to restrict outbound connections from Mealey servers to only known and necessary external endpoints on standard ports. Additionally, implementing strict output encoding and validating the resolved IP addresses against private or reserved address ranges can provide an additional layer of defense against SSRF attacks. Regular security audits of identity provider configurations and continuous monitoring for anomalous outbound traffic patterns are also recommended to detect potential exploitation attempts early in the kill chain.