These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A server-side request forgery vulnerability exists in Mealie 3.26.0 through 3.28.0, specifically in the OpenID Connect avatar fetch functionality. This vulnerability allows authenticated OIDC users who control their picture URL to make the server send GET requests to arbitrary ports on the provider's internal address on each login. The vulnerability has a CVSS score of 2.3 and is considered low severity.
A weakness in mealie-recipes Mealie up to 3.25.1 allows for server-side request forgery via the Recipe Action Trigger component. The issue is addressed in version 3.26.0. Defenders should assess exposure and apply the patch to prevent potential SSRF attacks. The vulnerability exists in the payload.model_dump function in mealie/routes/households/controller_group_recipe_actions.py, which can be exploited by [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-05T08:16:43.240Z and has not been modified since then. Mealie's AsyncSafeTransport SSRF guard resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-res [truncated]