Mealie CVE-2026-94028

Requires an authenticated Mealie account with permission to create or edit Recipe Actions in a household (PR:L) - not remote-unauthenticated. The vulnerable Recipe Action Trigger accepts an attacker-controlled url argument that the server fetches with no destination validation on versions up to 3.25.1. Exploitation is limited by: (1) authentication requirement; (2) likely blind SSRF (recipe actions are outbound webhook POSTs, so responses are not clearly returned to the attacker, hindering direct data exfiltration); (3) full mitigation once upgraded to 3.26.0, which enforces public-address-only outbound requests unless explicitly allowed via HTTP_ALLOW_LIST. Highest-value target is the cloud metadata endpoint or internal-only services reachable from the Mealie host.

This is a genuinely low-priority SSRF despite being remotely reachable. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N, score 2.1) correctly reflects the constraints: exploitation requires an authenticated household user (PR:L) to configure a Recipe Action, and impact is confidentiality-only and low (VC:L, VI:N/VA:N). The E:P (Proof-of-Concept) exploit maturity aligns with the reported public POC (Mealie GitHub issue #7831) - this is POC availability, NOT active exploitation. No CISA KEV listing and no EPSS score are provided; absence of KEV plus a self-hosted hobbyist-heavy footprint strongly suggests targeted opportunistic rather than widespread automated exploitation. The one signal that elevates concern above the tiny 2.1 score: the patch (PR #7914) reveals that before the fix, webhooks and recipe actions performed NO outbound-destination validation, so the SSRF could reach the cloud metadata endpoint (169.254.169.254), loopback, link-local, RFC1918, and CGNAT/Tailscale (100.64.0.0/10) ranges - a classic SSRF-to-metadata-credential path. However, recipe actions fire as outbound webhook POSTs where the response is not clearly reflected back to the attacker, so this is most likely BLIND SSRF, limiting straightforward data exfiltration and justifying VC:L over VC:H. Net: real but low-severity, gated behind authentication and a niche self-hosted product.

An authenticated Mealie household user creates or edits a Recipe Action, setting its trigger URL to an internal target such as the cloud metadata endpoint (http://169.254.169.254/) or an internal admin service. When the action fires, the Mealie server itself issues the request, reaching hosts the attacker cannot directly access. A public POC exists (Mealie GitHub issue #7831), lowering the barrier to reproduction, though the blind webhook nature limits direct data return.