CVE-2026-59970: Tandoor Recipes: Blind SSRF via AI provider URL (api_base)
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks when an authenticated user creates a Space, configures an AI provider with a URL targeting an internal address, and invokes an AI action. In cookbook/views/api.py, the affected AI actions call completion through TARGET/api/ai-import/ and api/ai-step-sort/ while bypassing saferequest. The attack works because the server connects to the supplied provider URL from each AI action and exposes connection success, refusal, or timeout as a blind network-reachability oracle. This can reach internal services, other hosts on the server network, and cloud metadata endpoints and map reachable internal hosts and ports. This issue is fixed in version 2.6.10.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tandoor Recipesto a version that resolves this vulnerability.Fixed in 2.6.10
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who can create a Space and configure an AI provider can exploit it. The vulnerable provider URL is administrator-controlled, so exposure depends on whether those users can set or influence that URL.
What does an attacker need to do to trigger the server-side request?
They must configure an AI provider URL that targets an internal address and invoke an affected AI action. The affected actions are reached through TARGET/api/ai-import/ and api/ai-step-sort/.
What can the attacker learn or reach?
The server can connect to internal services, other hosts on the server network, and cloud metadata endpoints. Connection success, refusal, and timeout behavior provides a blind oracle for mapping reachable internal hosts and ports.
Which versions are affected and what is the remediation?
Versions prior to 2.6.10 are affected. Upgrade to version 2.6.10, which fixes the missing outbound-request SSRF checks for these AI provider requests.