CVE-2026-108594 mealie-recipes CVE debrief

Who should care

Defenders responsible for Mealie systems, particularly those using OpenID Connect for authentication, should assess their exposure to this vulnerability and prioritize verification and potential remediation.

Why it matters

This vulnerability allows authenticated users to make arbitrary requests to internal network services, potentially bypassing security controls and gathering information about internal resources. Defenders should prioritize verifying affected versions, assessing exposure, and implementing compensating controls to limit potential impact.

• Potential information gathering about internal network services
• Possible bypass of security controls or access to sensitive internal resources
• Risk of lateral movement within the internal network
• Need for verification of affected versions and exposure

Technical summary

The vulnerability exists in the OpenID Connect avatar fetch functionality of Mealie, allowing authenticated OIDC users to make the server send GET requests to arbitrary ports on the provider's internal address. This could potentially be used to gather information about the internal network or services. The vulnerability has a CVSS score of 2.3 and is considered low severity. Affected versions include Mealie 3.26.0 through 3.28.0. Defenders should prioritize verifying the affected versions of Mealie and assessing the exposure of their systems to this vulnerability.

Defensive priority

Defenders should prioritize verifying the affected versions of Mealie and assessing the exposure of their systems to this vulnerability.

Recommended defensive actions

• Verify the version of Mealie being used and assess exposure to this vulnerability
• Restrict access to the Mealie system's internal network
• Monitor for suspicious activity related to OIDC avatar fetches
• Consider implementing compensating controls to limit the impact of potential SSRF attacks
• Review the configuration of OpenID Connect avatar fetch functionality
• Implement additional security controls to prevent SSRF attacks
• Track exceptions and retest remediated assets

Evidence notes

The vulnerability is confirmed to exist in Mealie versions 3.26.0 through 3.28.0. The CVE record and NVD entry provide details about the vulnerability, but the exact scope of affected systems and potential impact require further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.