{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/tandoor-recipes--2.6.12/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:tandoorrecipes:tandoor_recipes:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-59970"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Tandoor Recipes (\u003c 2.6.10)","Tandoor Recipes (\u003c 2.6.12)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","ssrf","reconnaissance","web-application","authentication-bypass","cve"],"_cs_type":"advisory","_cs_vendors":["Tandoor Recipes"],"content_html":"\u003cp\u003eTandoor Recipes versions prior to 2.6.10 are vulnerable to a blind Server-Side Request Forgery (SSRF) vulnerability. The flaw exists in how the application processes the 'api_base' parameter for AI provider configuration. Specifically, when an authenticated user creates a Space and configures an AI provider, the application fails to apply standard server-side outbound-request validation (safe_request) when interacting with LiteLLM.\u003c/p\u003e\n\u003cp\u003eBy providing a URL targeting internal network services or cloud metadata endpoints, an attacker can force the application server to make unauthorized requests. The application exposes the success, refusal, or timeout status of these requests back to the user interface during AI-driven actions (such as 'ai-import' or 'ai-step-sort'). This creates a blind network-reachability oracle, allowing attackers to map internal infrastructure, identify reachable ports, and potentially access sensitive metadata services within the hosting environment. This issue was resolved in version 2.6.10 by ensuring proper SSRF mitigation on these AI-related API endpoints.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the Tandoor Recipes instance as a user with Space creation permissions.\u003c/li\u003e\n\u003cli\u003eAttacker accesses the AI provider configuration settings within the Space management interface.\u003c/li\u003e\n\u003cli\u003eAttacker inputs a crafted internal URL (e.g., http://169.254.169.254 or internal service IPs) into the 'api_base' field.\u003c/li\u003e\n\u003cli\u003eAttacker triggers an AI action, such as 'ai-import' or 'ai-step-sort', within the application.\u003c/li\u003e\n\u003cli\u003eThe application backend processes the request and sends the malicious 'api_base' URL to the LiteLLM library without validation.\u003c/li\u003e\n\u003cli\u003eThe server attempts to connect to the target URL and receives a connection result (success, connection refused, or timeout).\u003c/li\u003e\n\u003cli\u003eThe application returns the request outcome to the user interface.\u003c/li\u003e\n\u003cli\u003eAttacker repeats the process with varying ports and target addresses to perform reconnaissance on the internal network.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows authenticated users to bypass network segmentation and discover internal infrastructure. The vulnerability impacts organizations hosting Tandoor Recipes in environments with access to cloud metadata services or sensitive internal networks, as it facilitates reconnaissance which is a common precursor to further exploitation or data exfiltration.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Tandoor Recipes to version 2.6.10 or later immediately.\u003c/li\u003e\n\u003cli\u003eApply strict egress filtering on the application server to prevent connections to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata services (e.g., 169.254.169.254).\u003c/li\u003e\n\u003cli\u003eAudit logs for the identified API endpoints (/api/ai-import/ and /api/ai-step-sort/) for unusually high rates of requests or non-standard external/internal URLs in the AI configuration parameters.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T20:44:59Z","date_published":"2026-10-16T20:44:41Z","id":"https://feed.craftedsignal.io/briefs/2026-10-tandoor-recipes-ssrf/","summary":"Authenticated users can exploit a blind Server-Side Request Forgery vulnerability in Tandoor Recipes versions prior to 2.6.10 by manipulating AI provider URL inputs to map internal network resources.","title":"Blind SSRF in Tandoor Recipes via AI Provider Configuration","url":"https://feed.craftedsignal.io/briefs/2026-10-tandoor-recipes-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Tandoor Recipes (\u003c 2.6.12)","version":"https://jsonfeed.org/version/1.1"}