CVE-2026-111899: KitchenOwl through 0.7.10 SSRF via Recipe Import scrapeKitchenOwl Fetch
KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that allows authenticated household members to bypass IP filtering via a second unfiltered fetch. Attackers can host a page titled KitchenOwl at a URL matching /recipe/<id>. The follow-up requests.get() call can then be redirected or DNS-rebound to loopback, private-network, or cloud-metadata addresses, exposing internal services.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated KitchenOwl household member can exploit it. The attacker must be able to supply a recipe-import URL that serves a page titled "KitchenOwl" and matches the /recipe/<id> URL pattern.
What internal targets could be exposed?
The unfiltered follow-up fetch can be redirected or DNS-rebound to loopback addresses, private-network services, or cloud metadata endpoints. This can expose services that are reachable from the KitchenOwl server but not from the attacker directly.
Does exploitation require user interaction or a complex attack path?
No user interaction is required. The issue has network attack vector, low attack complexity, and requires low privileges in the form of authenticated household-member access.