CVE-2026-71210

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71210", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-08-05T06:56:15.799Z", "datePublished": "2026-08-05T06:59:19.902Z", "dateUpdated": "2026-08-10T11:45:15.487Z"}, "containers": {"cna": {"title": "mealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal Network and Cloud Metadata Access", "descriptions": [{"lang": "en", "value": "Mealie's AsyncSafeTransport SSRF guard (mealie/pkgs/safehttp/transport.py) resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independently.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Mealie's AsyncSafeTransport SSRF guard (mealie/pkgs/safehttp/transport.py) resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independently.</p>"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition", "cweId": "CWE-367", "type": "CWE"}]}], "affected": [{"vendor": "mealie-recipes", "product": "mealie", "programFiles": ["mealie/pkgs/safehttp/transport.py"], "versions": [{"version": "0", "status": "affected"}], "defaultStatus": "unknown"}], "metrics": [{"other": {"type": "CVSS_3.1_severity", "content": {"value": "MEDIUM"}}}, {"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}}], "references": [{"url": "https://github.com/mealie-recipes/mealie", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "Sarvar Omonov", "type": "finder"}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:45:15.487Z"}, "source": {"discovery": "EXTERNAL"}, "datePublic": "2026-08-05T06:59:19.902Z"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-05T13:22:34.428070Z", "id": "CVE-2026-71210", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T13:22:45.960Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71210", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-05T13:22:34.428070Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T13:22:38.153Z"}}], "cna": {"title": "mealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal Network and Cloud Metadata Access", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Sarvar Omonov"}], "metrics": [{"other": {"type": "CVSS_3.1_severity", "content": {"value": "MEDIUM"}}}, {"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "mealie-recipes", "product": "mealie", "versions": [{"status": "affected", "version": "0"}], "programFiles": ["mealie/pkgs/safehttp/transport.py"], "defaultStatus": "unknown"}], "datePublic": "2026-08-05T06:59:19.902Z", "references": [{"url": "https://github.com/mealie-recipes/mealie", "tags": ["third-party-advisory"]}], "descriptions": [{"lang": "en", "value": "Mealie's AsyncSafeTransport SSRF guard (mealie/pkgs/safehttp/transport.py) resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independently.", "supportingMedia": [{"type": "text/html", "value": "<p>Mealie's AsyncSafeTransport SSRF guard (mealie/pkgs/safehttp/transport.py) resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independently.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-367", "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition"}]}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:45:15.487Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71210", "state": "PUBLISHED", "dateUpdated": "2026-08-10T11:45:15.487Z", "dateReserved": "2026-08-05T06:56:15.799Z", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "datePublished": "2026-08-05T06:59:19.902Z", "assignerShortName": "TuranSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "mealie", "programFiles": ["mealie/pkgs/safehttp/transport.py"], "vendor": "mealie-recipes", "versions": [{"status": "affected", "version": "0"}]}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mealie's AsyncSafeTransport SSRF guard (mealie/pkgs/safehttp/transport.py) resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independently."}, {"lang": "es", "value": "El guardi\u00e1n SSRF de AsyncSafeTransport de Mealie (mealie/pkgs/safehttp/transport.py) resuelve un nombre de host objetivo una vez, verifica la IP resuelta contra reglas de rango privado, pero luego emite la solicitud HTTP saliente real usando el nombre de host original, que el transporte as\u00edncrono subyacente vuelve a resolver de forma independiente. Debido a que la IP validada nunca se vincula a la conexi\u00f3n real, un atacante de reencuadernaci\u00f3n DNS (devolviendo una IP p\u00fablica a la b\u00fasqueda de validaci\u00f3n y una IP privada/de metadatos a la conexi\u00f3n real) burla al guardi\u00e1n. Esto es accesible por cualquier usuario autenticado a trav\u00e9s de /api/recipes/create/url, /api/recipes/test-scrape-url, y /api/recipes/{slug}/image, y el raspador refleja el contenido obtenido de vuelta al solicitante, permitiendo a un usuario autenticado leer servicios HTTP internos y puntos finales de metadatos en la nube."}], "id": "CVE-2026-71210", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71210", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-05T13:22:34.428070Z", "version": "2.0.3"}}]}, "published": "2026-08-05T08:16:43.240", "references": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/mealie-recipes/mealie"}], "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-367"}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "mealie", "source": "cna", "vendor": "mealie-recipes"}, "product": "mealie", "vendor": "mealie-recipes"}], "created": "2026-08-05T08:45:16.604630+00:00", "updated": "2026-08-10T21:45:03.635097+00:00", "vendors": ["mealie-recipes", "mealie-recipes$PRODUCT$mealie"]}