CVE-2026-94028 Details
Description
A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.model_dump of the file mealie/routes/households/controller_group_recipe_actions.py of the component Recipe Action Trigger. Executing a manipulation of the argument url can lead to server-side request forgery. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.26.0 is able to address this issue. This patch is called fb221afa258c8dd2c4ac95b1996c33ef9db3f477. The affected component should be upgraded.
A server-side request forgery (SSRF) vulnerability has been identified in Mealie Recipes versions through 3.25.1. The issue arises in the Recipe Action Trigger component, specifically within the payload.model_dump function of the file mealie/routes/households/controller_group_recipe_actions.py. The vulnerability allows authenticated users to manipulate the url argument of recipe actions, directing the server to make HTTP POST requests to arbitrary internal or external hosts. This bypasses existing SSRF protections and can be exploited to access private network services or cloud metadata endpoints that return sensitive information, such as IAM credentials on AWS.
Upgrade to Mealie version 3.26.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 20, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mealie-recipes/mealie/ | [email protected] | ProductVendor |
| https://github.com/mealie-recipes/mealie/commit/fb221afa258c8dd2c4ac95b1996c33ef9db3f477 | [email protected] | Source CodeVendor |
| https://github.com/mealie-recipes/mealie/issues/7831 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/mealie-recipes/mealie/pull/7914 | [email protected] | Vendor |
| https://github.com/mealie-recipes/mealie/releases/tag/v3.26.0 | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-94028 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/945043 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/407957 | [email protected] | BundlePermission Required |
| https://vuldb.com/vuln/407957/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mealie | <= 3.25.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 20, 2026 | New CVE Received | [email protected] |