MEDIUMVulnerability
CVE-2026-71210
Mealie's AsyncSafeTransport SSRF guard (mealie/pkgs/safehttp/transport.py) resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independently.
Properties
- severity
- MEDIUM
- score
- 5.3
- cve_id
- CVE-2026-71210
- vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- published_at
- 2026-08-05T08:16:43.240
- last_modified
- 2026-08-26T17:36:16.900
Related Entities (2)
HAS_WEAKNESS (1)
→[Weakness]Time-of-check Time-of-use (TOCTOU) Race Condition
DESCRIBED_BY (1)
→[Source]NVD
Explore deeper with Ninja Signal's threat intelligence graph