CVE-2026-94028: Server-Side Request Forgery in mealie-recipes Mealie
CVE-2026-94028 is a server-side request forgery (SSRF) vulnerability in Mealie up to version 3.25.1. It affects the payload.model_dump function in the Recipe Action Trigger component. The vulnerability allows remote attackers to manipulate the url argument, potentially causing the server to make unintended requests. The issue is fixed in version 3.26.0. The CVSS 4.0 base score is 5.3, indicating a medium severity level.
AI Analysis
Technical Summary
This vulnerability exists in the mealie-recipes Mealie product, specifically in the payload.model_dump function of the file mealie/routes/households/controller_group_recipe_actions.py within the Recipe Action Trigger component. By manipulating the url argument, an attacker can cause server-side request forgery, leading the server to make unauthorized requests. The vulnerability is remotely exploitable without user interaction and requires low privileges. The issue is addressed by upgrading to Mealie version 3.26.0, which includes the patch identified by commit fb221afa258c8dd2c4ac95b1996c33ef9db3f477.
Potential Impact
An attacker can remotely exploit this vulnerability to cause the server to perform unintended requests to internal or external resources. This could potentially lead to information disclosure or interaction with internal systems not otherwise accessible. The CVSS 4.0 score of 5.3 reflects a medium impact with low complexity and no privileges required.
Mitigation Recommendations
Upgrade affected Mealie installations from versions 3.25.0 and 3.25.1 to version 3.26.0, which contains the official fix for this SSRF vulnerability. No other mitigation steps are indicated by the vendor advisory.
CVE-2026-94028: Server-Side Request Forgery in mealie-recipes Mealie
Description
CVE-2026-94028 is a server-side request forgery (SSRF) vulnerability in Mealie up to version 3.25.1. It affects the payload.model_dump function in the Recipe Action Trigger component. The vulnerability allows remote attackers to manipulate the url argument, potentially causing the server to make unintended requests. The issue is fixed in version 3.26.0. The CVSS 4.0 base score is 5.3, indicating a medium severity level.
CVSS v4.0
Score 5.3medium
Affected software
mealie-recipes
Mealie
pkg:github/mealie-recipes/mealiecpe:2.3:a:mealie:mealie:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability exists in the mealie-recipes Mealie product, specifically in the payload.model_dump function of the file mealie/routes/households/controller_group_recipe_actions.py within the Recipe Action Trigger component. By manipulating the url argument, an attacker can cause server-side request forgery, leading the server to make unauthorized requests. The vulnerability is remotely exploitable without user interaction and requires low privileges. The issue is addressed by upgrading to Mealie version 3.26.0, which includes the patch identified by commit fb221afa258c8dd2c4ac95b1996c33ef9db3f477.
Potential Impact
An attacker can remotely exploit this vulnerability to cause the server to perform unintended requests to internal or external resources. This could potentially lead to information disclosure or interaction with internal systems not otherwise accessible. The CVSS 4.0 score of 5.3 reflects a medium impact with low complexity and no privileges required.
Mitigation Recommendations
Upgrade affected Mealie installations from versions 3.25.0 and 3.25.1 to version 3.26.0, which contains the official fix for this SSRF vulnerability. No other mitigation steps are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-19T17:08:20.244Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aafd95455bf5e2cf5107752
Added to database: 09/20/2026, 13:02:12 UTC
Last enriched: 09/20/2026, 13:16:30 UTC
Last updated: 09/20/2026, 13:25:53 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.