CVE-2026-115810 Details
Description
Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to issue GET requests to arbitrary internal or external hosts by crafting a malicious image URL in a Pestle JSON import file. Attackers can exploit the raw requests.get call in cookbook/integration/pestle.py, which bypasses the application's centralized requests-hardened SSRF filter, to reach internal-only endpoints, perform port/service discovery, and exfiltrate internal responses via the stored recipe image.
A server-side request forgery (SSRF) vulnerability has been identified in Tandoor Recipes versions prior to 2.7.0, specifically within the Pestle importer. This vulnerability allows authenticated low-privileged users to manipulate the server into sending GET requests to arbitrary internal or external hosts. The exploitation involves crafting a malicious image URL in a Pestle JSON import file. The issue arises because the Pestle importer uses a raw requests.get call that bypasses the application's centralized SSRF protection, enabling access to internal-only endpoints, port and service discovery, and exfiltration of internal responses via the stored recipe image.
Users can update to Tandoor Recipes version 2.7.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-xq7g-9q95-vjc6 | CISA-ADP | AdvisoryExploitTechnical DescriptionVendor |
| https://github.com/TandoorRecipes/recipes/releases/tag/2.7.0 | [email protected] | Release NotesVendor |
| https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-xq7g-9q95-vjc6 | [email protected] | AdvisoryExploitTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/tandoor-recipes-before-ssrf-via-pestle-importer-image-url | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tandoor Recipes | <= 2.6.15 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |