TI-2026-75528 Aliases CVE-2026-59970

Server-side request forgery in Tandoor Recipes AI provider URL

HIGH 67CWE-918Published 2026-10-16 · Updated 2026-10-21

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

Tandoor Recipes before 2.6.10 passes an administrator-controlled AI provider URL to LiteLLM without applying the server's outbound-request SSRF checks (CWE-918). An authenticated user who creates a Space and sets an AI provider URL to an internal address can trigger connections through an AI action. The server reports connection success, refusal, or timeout, which lets the attacker map reachable internal hosts and ports and reach cloud metadata endpoints.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks when an authenticated user creates a Space, configures an AI provider with a URL targeting an internal address, and invokes an AI action. In cookbook/views/api.py, the affected AI actions call completion through TARGET/api/ai-import/ and api/ai-step-sort/ while bypassing safe_request. The attack works because the server connects to the supplied provider URL from each AI action and exposes connection success, refusal, or timeout as a blind network-reachability oracle. This can reach internal services, other hosts on the server network, and cloud metadata endpoints and map reachable internal hosts and ports. This issue is fixed in version 2.6.10.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00311 24th percentileScored 2026-11-07

Fix Fixed recipes (TandoorRecipes): 2.6.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TandoorRecipes	recipes	before 2.6.10	2.6.10	Patch available	CNA

recipes VendorTandoorRecipes Affected before 2.6.10 Fixed in 2.6.10 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:tandoor:recipes::::::::	—	—	TandoorRecipes

cpe:2.3:a:tandoor:recipes:*:*:*:*:*:*:*:* Versions — — ·TandoorRecipes

Remediation

Upgrade Tandoor Recipes to version 2.6.10, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA recipes (TandoorRecipes) Fixed in 2.6.10

Timeline

2026-10-18 Threatist record created from CVE-2026-59970
2026-10-18 Priority changed: MEDIUM → LOW
2026-10-21 CISA SSVC decision points changed
2026-10-21 Priority changed: LOW → HIGH

References

Other 3

TI-2026-25582 Tandoor Recipes Vulnerable to Unrestricted Brute-Force via BasicAuthentication CVSS 3.1CRITICAL 9.1
TI-2025-16996 Tandoor Recipes - SSTI - Remote Code Execution CVSS 3.1CRITICAL 10.0
TI-2026-25583 SQL injection in TandoorRecipes recipes CVSS 4.0HIGH 7.7
TI-2026-27618 Tandoor Recipes — `amount`/`unit` bypass serializer in `food/{id}/shopping/` CVSS 3.1HIGH 7.3
TI-2025-16998 Tandoor Recipes - Stored XSS through Unrestricted File Upload CVSS 3.1HIGH 8.7
TI-2026-75529 Authorization bypass in Tandoor Recipes exposes private recipe steps CVSS 3.1HIGH 8.1

See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences