---
id: CVE-2026-59970
title: 'Tandoor Recipes: Blind SSRF via AI provider URL (api_base)'
summary: >-
  Tandoor Recipes is an application for managing recipes, planning meals, and
  building shopping lists. Prior to 2.6.10, passes an administrator-controlled
  AI provider URL directly to LiteLLM without applying the server's
  outbound-request S…
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-918
vendor: TandoorRecipes
product: recipes
affected:
  - recipes < 2.6.10
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:21:07.358Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-59970'
references:
  - url: >-
      https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-wq4h-2r8x-cv65
    label: >-
      https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-wq4h-2r8x-cv65
  - url: >-
      https://github.com/TandoorRecipes/recipes/commit/79e783578a5b198a988eb9b486ba19f93df4cfa4
    label: >-
      https://github.com/TandoorRecipes/recipes/commit/79e783578a5b198a988eb9b486ba19f93df4cfa4
  - url: 'https://github.com/TandoorRecipes/recipes/releases/tag/2.6.10'
    label: 'https://github.com/TandoorRecipes/recipes/releases/tag/2.6.10'
tags:
  - cve.org
  - exploit-available
ingestedAt: '2026-10-16T19:46:24.325Z'
epss: 0.00311
epssPercentile: 0.22409
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/asvorg/CVE-2026-59970-poc'
  checkedAt: '2026-10-17T17:28:01.896Z'
exploitAvailable: true
---

## Overview

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks when an authenticated user creates a Space, configures an AI provider with a URL targeting an internal address, and invokes an AI action. In cookbook/views/api.py, the affected AI actions call completion through TARGET/api/ai-import/ and api/ai-step-sort/ while bypassing safe_request. The attack works because the server connects to the supplied provider URL from each AI action and exposes connection success, refusal, or timeout as a blind network-reachability oracle. This can reach internal services, other hosts on the server network, and cloud metadata endpoints and map reachable internal hosts and ports. This issue is fixed in version 2.6.10.

## Affected

- `recipes < 2.6.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.