CVE-2026-59970
7.7HighPublished 16 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-918
Impact
Authenticated attackers can scan internal ports, reach private network hosts, and query cloud metadata services via blind server-side request forgery. They only need an account capable of creating a Space and configuring an AI provider URL.
Root cause
The AI integration endpoints invoke LiteLLM using user-supplied provider URLs directly without passing them through the application's safe_request SSRF validation.
Affected systems
Tandoor Recipes prior to 2.6.10
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Fix & remediation
Upgrade Tandoor Recipes to version 2.6.10 or later. If updating immediately is not possible, restrict network egress from the application container to prevent connections to internal IP ranges and cloud metadata endpoints.
$ docker compose pull web_recipes && docker compose up -d web_recipesAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks when an authenticated user creates a Space, configures an AI provider with a URL targeting an internal address, and invokes an AI action. In cookbook/views/api.py, the affected AI actions call completion through TARGET/api/ai-import/ and api/ai-step-sort/ while bypassing safe_request. The attack works because the server connects to the supplied provider URL from each AI action and exposes connection success, refusal, or timeout as a blind network-reachability oracle. This can reach internal services, other hosts on the server network, and cloud metadata endpoints and map reachable internal hosts and ports. This issue is fixed in version 2.6.10.