CyberRota Analysis
AI-GeneratedMealie's AsyncSafeTransport is vulnerable to Server-Side Request Forgery (SSRF) due to improper handling of hostname resolution, allowing attackers to exploit DNS rebinding techniques. This vulnerability enables authenticated users to access internal HTTP services and cloud metadata endpoints, potentially exposing sensitive information. Organizations using Mealie should prioritize remediation, especially those with authenticated user access, to mitigate the risk of unauthorized data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Mealie's AsyncSafeTransport SSRF guard (mealie/pkgs/safehttp/transport.py) resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independently.