CVE-2026-71210

{
  "id": "CVE-2026-71210",
  "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
  "published": "2026-08-05T08:16:43.240",
  "lastModified": "2026-10-24T15:10:00.190",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mealie's AsyncSafeTransport SSRF guard (mealie/pkgs/safehttp/transport.py) resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independently."
    },
    {
      "lang": "es",
      "value": "El guardián SSRF de AsyncSafeTransport de Mealie (mealie/pkgs/safehttp/transport.py) resuelve un nombre de host objetivo una vez, verifica la IP resuelta contra reglas de rango privado, pero luego emite la solicitud HTTP saliente real usando el nombre de host original, que el transporte asíncrono subyacente vuelve a resolver de forma independiente. Debido a que la IP validada nunca se vincula a la conexión real, un atacante de reencuadernación DNS (devolviendo una IP pública a la búsqueda de validación y una IP privada/de metadatos a la conexión real) burla al guardián. Esto es accesible por cualquier usuario autenticado a través de /api/recipes/create/url, /api/recipes/test-scrape-url, y /api/recipes/{slug}/image, y el raspador refleja el contenido obtenido de vuelta al solicitante, permitiendo a un usuario autenticado leer servicios HTTP internos y puntos finales de metadatos en la nube."
    }
  ],
  "affected": [
    {
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "affectedData": [
        {
          "vendor": "mealie-recipes",
          "product": "mealie",
          "defaultStatus": "unknown",
          "programFiles": [
            "mealie/pkgs/safehttp/transport.py"
          ],
          "versions": [
            {
              "version": "0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-05T13:22:34.428070Z",
          "id": "CVE-2026-71210",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-367"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/mealie-recipes/mealie",
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"
    }
  ]
}