LOW 2.3 NVD
CVE-2026-108594
Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the id
Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity provider hostname. Authenticated OIDC users who control their picture URL can make the server send GET requests to arbitrary ports on the provider's internal address on each login.
References
- https://github.com/mealie-recipes/mealie
- https://github.com/mealie-recipes/mealie/blob/v3.28.0/mealie/core/security/providers/openi
- https://github.com/mealie-recipes/mealie/blob/v3.28.0/mealie/pkgs/safehttp/transport.py#L6
- https://hackmd.io/@haind/mealie-oidc-avatar-ssrf
- https://www.vulncheck.com/advisories/mealie-3.26.0-through-3.28.0-ssrf-via-oidc-picture-cl
This low severity vulnerability with a CVSS score of 2.3 was published on 2026-10-10 via NVD.
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.