CVE-2026-108594CWE-918ssrf

CVE-2026-108594

Low · published October 10, 2026

CVSS v3.1
3.5
EPSS
0%
Percentile
8.2
In the wild
Unconfirmed
What it is

Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity provider hostname. Authenticated OIDC users who control their picture URL can make the server send GET requests to arbitrary ports on the provider's internal address on each login.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
2.3 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00190 · 8.2th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-10-10T23:16Z
References (5)
https://github.com/mealie-recipes/mealie · [email protected]https://github.com/mealie-recipes/mealie/blob/v3.28.0/mealie/core/security/providers/openid_provider.py#L170-L200 · [email protected]https://github.com/mealie-recipes/mealie/blob/v3.28.0/mealie/pkgs/safehttp/transport.py#L60-L160 · [email protected]https://hackmd.io/@haind/mealie-oidc-avatar-ssrf · [email protected]https://www.vulncheck.com/advisories/mealie-3.26.0-through-3.28.0-ssrf-via-oidc-picture-claim-avatar-fetch · [email protected]
EPSS history
Timeline
  • 12 OCT 03:26Z
    EPSS moved — → 0%
    epss
  • 10 OCT 18:16Z
    Mealie 3.26.0 through 3.28.0 SSRF via OIDC Picture Claim Avatar Fetch
    cvelistv5
  • 10 OCT 18:16Z
    Mealie 3.26.0 through 3.28.0 SSRF via OIDC Picture Claim Avatar Fetch
    cvelistv5