CVE-2026-71210: mealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal Network and Cloud Metadata Access

Published Aug 5, 2026

Updated

Mealie's AsyncSafeTransport SSRF guard (mealie/pkgs/safehttp/transport.py) resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independently.

Affected Software

1 affected component

Mealie

Event History

Aug 5, 2026

CVE Published

via MITRE·06:59 AM

Data Sourced

via MITRE·06:59 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:16 AM

DescriptionSeverityWeakness

Feb 14, 58566

Event

via NVD·02:17 AM

Frequently Asked Questions

What is the severity of CVE-2026-71210?

CVE-2026-71210 has a medium severity score of 6.5.

What is the main issue described in CVE-2026-71210?

CVE-2026-71210 describes a DNS-Rebinding TOCTOU vulnerability in Mealie's AsyncSafeTransport SSRF guard, which allows access to internal network and cloud metadata.

How do I fix CVE-2026-71210?

To mitigate CVE-2026-71210, ensure the SSRF guard is updated to properly check and limit hostname resolution before making outbound HTTP requests.

What software is affected by CVE-2026-71210?

CVE-2026-71210 affects the Mealie package located in 'mealie/pkgs/safehttp/transport.py'.

When was CVE-2026-71210 published?

CVE-2026-71210 was published on August 5, 2026.