CVE-2026-59970

Received Received - Intake

SSRF Bypass in Tandoor Recipes via AI Provider URL

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks when an authenticated user creates a Space, configures an AI provider with a URL targeting an internal address, and invokes an AI action. In cookbook/views/api.py, the affected AI actions call completion through TARGET/api/ai-import/ and api/ai-step-sort/ while bypassing safe_request. The attack works because the server connects to the supplied provider URL from each AI action and exposes connection success, refusal, or timeout as a blind network-reachability oracle. This can reach internal services, other hosts on the server network, and cloud metadata endpoints and map reachable internal hosts and ports. This issue is fixed in version 2.6.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-16

Generated

2026-10-17

AI Q&A

2026-10-17

EPSS Evaluated

N/A

NVD

CVE-2026-59970

EUVD

EUVD-2026-103145

Affected Vendors & Products

Vendor	Product	Version / Range
TandoorRecipes	recipes	< 2.6.10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

Tandoor Recipes before 2.6.10 has a Server-Side Request Forgery (SSRF) vulnerability. When an authenticated user creates a Space and configures an AI provider with an internal URL, the application passes this URL directly to LiteLLM without applying outbound-request SSRF checks. This allows attackers to map internal network hosts and ports by exploiting blind network-reachability oracles through AI actions.

Detection Guidance

Check Tandoor Recipes version for 2.6.10 or higher. Monitor outbound requests from the server to internal or unexpected addresses. Inspect logs for AI provider URL configurations targeting internal networks.

Impact Analysis

An attacker could exploit this to access internal services, other hosts on the server network, or cloud metadata endpoints. This could lead to unauthorized data access, network reconnaissance, or further attacks on internal systems. The impact includes potential data breaches and compromised system integrity.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Non-compliance may result in legal penalties, fines, or reputational damage due to exposed personal or health information.

Mitigation Strategies

Upgrade to Tandoor Recipes version 2.6.10 or later. Disable AI provider configurations pointing to internal addresses. Implement network-level SSRF protections for outbound requests.

Hi! I’m here to help you understand CVE-2026-59970. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70