CVE-2026-94028 mealie-recipes CVE debrief

Who should care

Defenders responsible for mealie-recipes Mealie deployments should assess exposure and apply the patch to prevent potential SSRF attacks. This includes operators, platform administrators, vulnerability management teams, and security teams. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where

Why it matters

Defenders should prioritize verifying exposure and applying the patch to prevent potential SSRF attacks in mealie-recipes Mealie up to 3.25.1.

• Potential SSRF attacks may lead to unauthorized requests to internal resources.
• Verification of exposure and patch application is necessary to prevent exploitation.

Technical summary

The payload.model_dump function in mealie/routes/households/controller_group_recipe_actions.py is vulnerable to server-side request forgery due to manipulation of the url argument. This weakness allows for SSRF attacks. The issue is addressed in version 3.26.0. Defenders should prioritize verifying exposure and applying the patch to prevent potential SSRF attacks. The vulnerability can be exploited remotely and the exploit has been made public. Affected is the function payload.model_dump of the file mealie/routes/households/controller_group_recipe_actions.py of the component Recipe Action Trigger.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch to prevent potential SSRF attacks.

Recommended defensive actions

• Verify if the Recipe Action Trigger component is in use and assess exposure to potential SSRF attacks.
• Upgrade to version 3.26.0 to apply the patch.
• Monitor for potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, but further verification is needed to confirm affected versions and potential impact. The affected component should be upgraded. The patch is called fb221afa258c8dd2c4ac95b1996c33ef9db3f477. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.