CVE-2026-108594— Mealie 3.26.0 through 3.28.0 SSRF via OIDC Picture Claim Avatar Fetch
Quick assessment
Affected
mealie-recipes mealie
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Mealie 3.26.0 至 3.28.0 版本中存在服务器端请求伪造（SSRF）漏洞，该漏洞出现在 OpenID Connect（OIDC）头像获取功能中，其在白名单校验身份提供程序（IdP）主机名时忽略了端口号。经过身份验证的 OIDC 用户若能够控制自己的头像 URL，则可在每次登录时诱导服务器向身份提供程序内部地址的任意端口发起 GET 请求。
Possible ATT&CK Techniques 1 AI
T1001 · Data ObfuscationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| mealie-recipes | mealie | 3.26.0≤ 3.28.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-108594
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Mealie 3.26.0 through 3.28.0 SSRF via OIDC Picture Claim Avatar Fetch
Source: CVE Program / CVE List V5
Vulnerability Description
Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity provider hostname. Authenticated OIDC users who control their picture URL can make the server send GET requests to arbitrary ports on the provider's internal address on each login.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| mealie-recipes | mealie | 3.26.0 ~ 3.28.0 | - |
|
II. Public POCs for CVE-2026-108594
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-108594
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-108594 (2)
-
-
🔗 Unicorn! · GitHub technical-description
Vendor Advisories for CVE-2026-108594 (1)
News Coverage for CVE-2026-108594 (1)
Other References for CVE-2026-108594 (1)
IV. Related Vulnerabilities
Same product: mealie
-
CVE-2026-94028
mealie-recipes Mealie Recipe Action Trigger controller_group -
CVE-2026-93736
Mealie before 3.21.0 Information Disclosure via Ratings Endp -
CVE-2026-71210
mealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal -
CVE-2024-31994
Mealie vulnerable to a DoS in recipe image importer (GHSL-20 -
CVE-2024-31993
Mealie vulnerable to a GET-based SSRF in recipe image import
Same vendor: mealie-recipes
-
CVE-2026-94028
mealie-recipes Mealie Recipe Action Trigger controller_group -
CVE-2026-93736
Mealie before 3.21.0 Information Disclosure via Ratings Endp -
CVE-2026-71210
mealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal -
CVE-2024-31994
Mealie vulnerable to a DoS in recipe image importer (GHSL-20 -
CVE-2024-31993
Mealie vulnerable to a GET-based SSRF in recipe image import
Same weakness: CWE-918
-
CVE-2026-100104
Server-Side Request Forgery (SSRF) in GitLab -
CVE-2026-89111
OAuth2 SSRF vulnerability in SAP Cloud SDK for Python -
CVE-2026-108939
EricLBuehler mistral.rs media_source.rs is_global_ip server- -
CVE-2026-109651
Frappe ERPNext before 15.112.0 Server-Side Request Forgery v -
CVE-2026-109603
Frappe Framework before 16.17.0 Authenticated SSRF and LFI v
V. Comments for CVE-2026-108594
No comments yet