CVE-2026-111899 Details
Description
KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that allows authenticated household members to bypass IP filtering via a second unfiltered fetch. Attackers can host a page titled KitchenOwl at a URL matching /recipe/<id>. The follow-up requests.get() call can then be redirected or DNS-rebound to loopback, private-network, or cloud-metadata addresses, exposing internal services.
A server-side request forgery (SSRF) vulnerability has been identified in KitchenOwl versions through 0.7.10. This vulnerability allows authenticated household members to bypass IP filtering during the recipe import process. The issue arises because the application first fetches a user-supplied URL using a hardened HTTP client that includes IP filtering and disallows loopback addresses. However, if the fetched page title indicates it is a KitchenOwl instance, the application trusts the URL's origin and makes a second request through an unfiltered HTTP client. This second request can be redirected to internal network addresses or cloud metadata endpoints, exposing sensitive internal services.
Users can update to KitchenOwl version 0.7.10 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/TomBursch/kitchenowl/blob/v0.7.10/backend/app/service/recipe_scraping.py | [email protected] | Source CodeVendor |
| https://github.com/TomBursch/kitchenowl/commit/292f6f50a8e8bfa487292e9fd0ea0c54a860c28f | [email protected] | Source CodeVendor |
| https://github.com/TomBursch/kitchenowl/issues/1169 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/kitchenowl-through-0.7.10-ssrf-via-recipe-import-scrapekitchenowl-fetch | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| KitchenOwl | <= 0.7.10 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |