CVE-2026-71210: Mealie SSRF Vulnerability

CVE-2026-71210 Overview

CVE-2026-71210 is a Server-Side Request Forgery (SSRF) vulnerability in Mealie, an open-source recipe management application. The flaw resides in the AsyncSafeTransport guard implemented in mealie/pkgs/safehttp/transport.py. The guard resolves a target hostname once and validates the resolved IP against private-range rules, but the outbound HTTP request is issued using the original hostname. The underlying async transport re-resolves the name independently, creating a Time-of-Check Time-of-Use (TOCTOU) condition [CWE-367] exploitable through DNS rebinding.

Critical Impact
Any authenticated Mealie user can read internal HTTP services and cloud-metadata endpoints because the scraper reflects fetched content back to the requester.

Affected Products

Mealie recipe management application
mealie/pkgs/safehttp/transport.py (AsyncSafeTransport component)
Endpoints: /api/recipes/create/url, /api/recipes/test-scrape-url, /api/recipes/{slug}/image

Discovery Timeline

2026-08-05 - CVE-2026-71210 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71210

Vulnerability Analysis

Mealie enforces SSRF protection through AsyncSafeTransport, which validates that a target hostname does not resolve to a private, loopback, or link-local IP address. The guard performs a single DNS lookup, evaluates the resulting IP, and then hands the original hostname to the async HTTP transport. The transport performs its own DNS resolution when opening the socket. The validated IP is never pinned to the actual TCP connection.

An attacker controlling an authoritative DNS server can return different answers to sequential queries for the same hostname. The first query, issued by the validator, returns a public IP that passes the private-range check. The second query, issued by the transport at connection time, returns a private address such as 169.254.169.254 or 127.0.0.1. The scraper then fetches content from the internal target and reflects it back to the caller as recipe metadata or image data.

Three endpoints reach this code path and all require only authenticated user privileges: /api/recipes/create/url, /api/recipes/test-scrape-url, and /api/recipes/{slug}/image.

Root Cause

The root cause is a classic TOCTOU flaw [CWE-367]. Validation and use operate on the hostname rather than on a single resolved IP. Because DNS resolution is repeated independently, the security decision made at check time does not bind the connection made at use time.

Attack Vector

An authenticated attacker registers a domain and configures a DNS server that alternates responses between a benign public IP and a target internal address such as an AWS Instance Metadata Service (IMDS) endpoint. The attacker submits the domain to a vulnerable endpoint. Mealie validates the hostname, then reconnects and retrieves content from the internal service. The response body is returned in the API reply, allowing extraction of cloud credentials, internal service data, or metadata secrets.

The vulnerability mechanism is described in prose because no verified exploit code is publicly available. Refer to the Mealie GitHub repository for source-level details.

Detection Methods for CVE-2026-71210

Indicators of Compromise

Outbound DNS queries from Mealie hosts to unusual or attacker-controlled authoritative name servers.
HTTP requests originating from the Mealie service to RFC1918 addresses, 127.0.0.0/8, or 169.254.169.254.
Repeated calls to /api/recipes/create/url, /api/recipes/test-scrape-url, or /api/recipes/{slug}/image with hostnames that resolve inconsistently.
Unexpected recipe entries or image records containing raw JSON payloads resembling cloud metadata responses.

Detection Strategies

Monitor egress traffic from the Mealie container or host and alert on connections to link-local and private ranges.
Correlate DNS resolver logs with Mealie application logs to identify hostnames returning multiple distinct IPs within short windows.
Inspect recipe scrape logs for URLs whose resolved IPs fall outside expected public ranges.

Monitoring Recommendations

Enable structured logging on the safehttp module and forward events to a centralized SIEM.
Alert on authenticated API activity targeting scrape endpoints at abnormal volume or frequency.
Track cloud IMDS access counters from any workload running Mealie.

How to Mitigate CVE-2026-71210

Immediate Actions Required

Update Mealie to a release that contains the fix for CVE-2026-71210 once available from the Mealie project.
Restrict outbound network access from the Mealie service using host firewall or Kubernetes NetworkPolicy rules that deny RFC1918 and link-local destinations.
On AWS workloads, enforce IMDSv2 and set the metadata hop limit to 1 to prevent container-based access.
Audit existing user accounts and disable self-registration if not required.

Patch Information

Consult the Mealie GitHub repository for the corrective commit and release notes. The fix requires pinning the validated IP to the outbound connection, for example by resolving once and dialing the resolved address directly while preserving the Host header, or by using a resolver that returns a single address reused for both validation and connection.

Workarounds

Deploy Mealie behind an egress proxy that enforces destination allow-listing to public recipe sites only.
Block DNS answers containing private, loopback, and link-local addresses at the resolver using RPZ or a filtering DNS service.
Disable the URL scraping endpoints via reverse-proxy rules until a patched version is deployed.

bash

# Example: block egress from the Mealie container to internal ranges (iptables)
iptables -I DOCKER-USER -s <mealie_container_ip> -d 169.254.169.254 -j DROP
iptables -I DOCKER-USER -s <mealie_container_ip> -d 10.0.0.0/8 -j DROP
iptables -I DOCKER-USER -s <mealie_container_ip> -d 172.16.0.0/12 -j DROP
iptables -I DOCKER-USER -s <mealie_container_ip> -d 192.168.0.0/16 -j DROP
iptables -I DOCKER-USER -s <mealie_container_ip> -d 127.0.0.0/8 -j DROP