CVE-2026-111899
Received Received - Intake

Server-Side Request Forgery in KitchenOwl Recipe Import

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulnCheck

Description
KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that allows authenticated household members to bypass IP filtering via a second unfiltered fetch. Attackers can host a page titled KitchenOwl at a URL matching /recipe/<id>. The follow-up requests.get() call can then be redirected or DNS-rebound to loopback, private-network, or cloud-metadata addresses, exposing internal services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-111899
EUVD
EUVD-2026-104319

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
TomBursch kitchenowl 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

KitchenOwl through 0.7.10 has a Server-Side Request Forgery (SSRF) vulnerability in its recipe import feature. When a user imports a recipe, the application makes a second unfiltered HTTP request if the fetched page's title contains the literal string 'KitchenOwl'. This second request bypasses IP filtering and other protections, allowing attackers to trick the server into fetching internal network resources like loopback or private addresses.

Detection Guidance

Monitor network traffic for unexpected outbound requests from the KitchenOwl backend to internal or private IP addresses. Check logs for recipe import operations that trigger secondary requests to localhost, 127.0.0.1, or other internal network ranges. Use tools like tcpdump or Wireshark to capture traffic from the KitchenOwl server process.

Impact Analysis

Authenticated household members can exploit this to make the server access internal services not directly reachable. The server may return sensitive data from internal resources disguised as recipe data. Attackers could map internal networks, access cloud metadata, or interact with services like databases or APIs running on the same network.

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to internal systems, potentially exposing sensitive data. For GDPR, this may violate principles of data protection and security. For HIPAA, it could risk unauthorized access to protected health information. Compliance may be impacted if internal systems store regulated data.

Mitigation Strategies

Upgrade KitchenOwl to the latest patched version immediately. If upgrading is not possible, disable the recipe import feature or restrict network access for the KitchenOwl server to prevent outbound connections to internal addresses. Review and apply the security fix from commit 292f6f50a8e8bfa487292e9fd0ea0c54a860c28f.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111899. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart