CVE-2026-108594: Mealie 3.26.0 through 3.28.0 SSRF via OIDC Picture Claim Avatar Fetch
Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity provider hostname. Authenticated OIDC users who control their picture URL can make the server send GET requests to arbitrary ports on the provider's internal address on each login.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who signs in through OpenID Connect and can control the picture URL in their OIDC claims can trigger the requests. The impact is limited to requests sent to ports on the configured identity provider's internal address.
Is the vulnerability triggered automatically during normal use?
The server fetches the avatar URL on each login for an affected OIDC user. Exploitation therefore requires the attacker to log in with a controlled picture claim.
How can I tell whether my deployment is affected?
Deployments running Mealie versions 3.26.0 through 3.28.0 are affected when OpenID Connect avatar fetching is in use. Review OIDC login activity and server-side outbound GET requests to unexpected ports on the identity provider address.