Mealie CVE-2026-108594

Requires an authenticated OIDC user who can control their own identity-provider 'picture'/avatar claim, and requires Mealie to be configured to use OpenID Connect authentication (non-default for many installs). Exploitation is further bounded to the OIDC provider's own hostname/address: the flawed allowlist validates the provider hostname but ignores the port, so the attacker can only redirect fetches to arbitrary PORTS on the already-allowlisted provider address, not to fully arbitrary hosts. The fetch is a server-side GET issued on each login, so impact is limited to blind interaction/reconnaissance against services reachable at the provider's internal address; there is no indication response contents are returned to the attacker. Limiting factors: OIDC must be enabled, the attacker must hold a valid account on the trusted IdP, and the IdP address must co-locate reachable internal services.

This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The vendor-supplied CVSS 4.0 score is 2.3 (Low), reflecting authenticated access (PR:L), a present attack requirement (AT:P - the OIDC provider must expose reachable internal ports), and only limited confidentiality impact on both the vulnerable and a subsequent system (VC:L/SC:L) with no integrity or availability impact. Exploitation status is 'no public exploit identified at time of analysis' - this CVE is NOT in CISA KEV and no exploit-code flag is present in the input, so there is no evidence of active exploitation. A technical writeup exists on HackMD and the vendor (VulnCheck) published an advisory, which raises research visibility but is distinct from weaponized exploit code or in-the-wild use. EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be quantified. The net picture: a real, confirmed SSRF primitive (CWE-918) but one that is blind (GET-only, no response body exfiltration indicated), authenticated, and bounded to the identity provider's address space - a plausible internal port-scan / reconnaissance tool against the IdP rather than a broad RCE or data-exfiltration threat. Patch by upgrading past the 3.26.0-3.28.0 affected range once a fixed release is confirmed.

An authenticated OIDC user sets their identity-provider 'picture' claim to a URL pointing at an internal port on the provider's address (e.g. http://idp-internal:6379/), and on each subsequent login Mealie's avatar fetch issues a server-side GET to that host:port because the allowlist checks the hostname but ignores the port. The attacker can thereby probe or interact with internal services co-located with the IdP from the Mealie server's network position. No public exploit code is identified, though a technical writeup describing the flaw is publicly available.