CVE-2026-71210: mealie: DNS-Rebinding TOCTOU in SSRF Guard Allows Internal Network and Cloud Metadata Access
Mealie's AsyncSafeTransport SSRF guard (mealie/pkgs/safehttp/transport.py) resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independently. Because the validated IP is never pinned to the actual connection, a DNS-rebinding attacker (returning a public IP to the validation lookup and a private/metadata IP to the real connection) defeats the guard. This is reachable by any authenticated user via /api/recipes/create/url, /api/recipes/test-scrape-url, and /api/recipes/{slug}/image, and the scraper reflects fetched content back to the requester, allowing an authenticated user to read internal HTTP services and cloud-metadata endpoints.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the SSRF guard so it does not resolve the target hostname for validation and then re-resolve it again for the actual outbound HTTP request. After resolving once and validating the resolved IP against private-range rules, use that resolved IP for the real connection (or otherwise ensure the same resolved address is used), preventing DNS-rebinding TOCTOU via /api/recipes/create/url, /api/recipes/test-scrape-url, and /api/recipes/{slug}/image.
Mealie AsyncSafeTransport SSRF guard (mealie/pkgs/safehttp/transport.py) DNS resolution / hostname re-use behavior = Use the already-validated resolved IP for the outbound request instead of the original hostname (avoid re-resolving)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71210?
CVE-2026-71210 has a medium severity score of 6.5.
What is the main issue described in CVE-2026-71210?
CVE-2026-71210 describes a DNS-Rebinding TOCTOU vulnerability in Mealie's AsyncSafeTransport SSRF guard, which allows access to internal network and cloud metadata.
How do I fix CVE-2026-71210?
To mitigate CVE-2026-71210, ensure the SSRF guard is updated to properly check and limit hostname resolution before making outbound HTTP requests.
What software is affected by CVE-2026-71210?
CVE-2026-71210 affects the Mealie package located in 'mealie/pkgs/safehttp/transport.py'.
When was CVE-2026-71210 published?
CVE-2026-71210 was published on August 5, 2026.