CVE-2026-71210 mealie-recipes CVE debrief

Who should care

Authenticated users of Mealie's AsyncSafeTransport, administrators of internal HTTP services and cloud-metadata endpoints, security teams monitoring for DNS rebinding attacks, and operators of affected platforms should be aware of this vulnerability and take necessary precautions to mitigate it.

Technical summary

Mealie's AsyncSafeTransport SSRF guard resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independently. This allows a DNS-rebinding attacker to defeat the guard, enabling authenticated users to read internal HTTP services and cloud-metadata endpoints. The vulnerability is reachable by any authenticated user via /api/recipes/create/url, /api/recipes/test-scrape-url, and /api/recipes/{slug}/image, and the scraper reflects fetched content back to the requester.

Defensive priority

Authenticated users should verify and limit access to internal HTTP services and cloud-metadata endpoints.

Recommended defensive actions

• Verify and limit access to internal HTTP services and cloud-metadata endpoints.
• Implement additional security measures to prevent DNS rebinding attacks.
• Monitor for suspicious activity related to authenticated user access.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE description indicates that Mealie's AsyncSafeTransport SSRF guard is vulnerable to DNS rebinding attacks, allowing authenticated users to read internal HTTP services and cloud-metadata endpoints. The guard resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independently. This means that an attacker can exploit this vulnerability by returning a public IP to the validation lookup and a private/metadata IP to the real connection, effectively defeating the guard. To verify and mitigate this vulnerability, defenders should review the affected product deployments, validate the scope and severity of the vulnerability, and implement additional security measures to prevent DNS rebinding attacks.

Official resources