Mealie's AsyncSafeTransport SSRF guard (mealie/pkgs/safehttp/transport.py) resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTT…

Medium CVSS 5.3

CVECVE-2026-71210

First seen2026-08-10 13:15 UTC

Disclosed2026-08-05 08:16 UTC

Last updated2026-08-10 13:15 UTC

Channel statusauto

Summary

Mealie's AsyncSafeTransport SSRF guard (mealie/pkgs/safehttp/transport.py) resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independently.

In-depth triage · Auto channel

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Sources

NVD DATABASE

Original Links

https://github.com/mealie-recipes/mealie

Timeline

2026-08-10 nvd_ingest NVD