TechPrufer
Sign inGet started

Blogs›Meilisearch›SSRF Vulnerability Fix

SSRF Vulnerability Fix

SSRF Vulnerability Fix

1
posts
2026

Meilisearch has addressed an authenticated, blind Server-Side Request Forgery (SSRF) vulnerability in versions v1.8 to v1.34.0. The fix, implemented in v1.34.1, prevents Meilisearch instances from making requests to non-global IP addresses. For specific use cases requiring such functionality, an experimental parameter `--experimental-allow-ip-networks` is available, with a strong recommendation to review security implications and apply defense-in-depth principles. Meilisearch Cloud customers are unaffected.

2026

Meilisearch security update: SSRF vulnerability fixed in v1.34.1

1/27/2026

This post details a Server-Side Request Forgery (SSRF) vulnerability in Meilisearch versions v1.8 to v1.34.0, allowing authenticated users with write permissions to trigger POST or GET requests to local network domains/IPs. It describes the fix implemented in v1.34.1, which blocks requests to non-global IP addresses, and introduces an experimental parameter `--experimental-allow-ip-networks` for specific use cases, emphasizing security best practices.