OCTOBER 13, 2026
Live Feed
Back to database
Case File

CVE-2026-108594

LOW · CVSS 3.5 EPSS 0.19% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-10-10 · Last synced 2026-10-13

CyberRota Analysis

AI-Generated

Mealie versions 3.26.0 to 3.28.0 are vulnerable to a server-side request forgery (SSRF) that allows authenticated OpenID Connect users to exploit the avatar fetch feature, bypassing port restrictions on the allowlisted identity provider hostname. This could lead to unauthorized access to internal services by sending GET requests to arbitrary ports upon user login. Organizations using these versions should prioritize patching to mitigate potential exploitation risks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-108594
Severity
LOW
CVSS
3.5
EPSS
0.19%

Original NVD Description

Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity provider hostname. Authenticated OIDC users who control their picture URL can make the server send GET requests to arbitrary ports on the provider's internal address on each login.