CVE-2026-115810High· 7.7▾ TwilightTandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to issue GET requests to arbitrary internal or external hosts by …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to issue GET requests to arbitrary internal or external hosts by crafting a malicious image URL in a Pestle JSON import file. Attackers can exploit the raw requests.get call in cookbook/integration/pestle.py, which bypasses the application's centralized requests-hardened SSRF filter, to reach internal-only endpoints, perform port/service discovery, and exfiltrate internal responses via the stored recipe image.
recipes >= 2.0.0 < 2.7.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-59970High· 7.7Tandoor Recipes: Blind SSRF via AI provider URL (api_base)
CVE-2026-59963High· 7.1Tandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpoints
CVE-2026-61726High· 8.1Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content
CVE-2026-59966Medium· 5.7Tandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex Patterns
CVE-2026-59962Medium· 6.5Tandoor Recipes: ORM ORDER BY Injection via FK Traversal in Tandoor Recipes
CVE-2026-59967Medium· 5.4Tandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet import — read and destroy another space member's pending BookmarkletImport