CVE-2026-111899: Server-Side Request Forgery (SSRF) in TomBursch kitchenowl

CVE-2026-111899 describes an SSRF vulnerability in KitchenOwl through version 0.7.10. The flaw exists in the recipe import functionality, where an attacker who is an authenticated household member can bypass IP filtering via a second unfiltered HTTP fetch request. By hosting a page at a URL matching /recipe/<id>, attackers can cause the application to make follow-up requests that can be redirected or DNS-rebound to internal network addresses such as loopback, private network, or cloud metadata endpoints, potentially exposing sensitive internal services.

The vulnerability allows authenticated users to perform SSRF attacks that bypass IP filtering controls. This can lead to exposure of internal services and sensitive metadata endpoints that are normally inaccessible from outside the network. However, exploitation requires authentication as a household member, limiting the attack surface. No known exploits in the wild have been reported.

No vendor advisory or patch information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user privileges and monitor for suspicious activity related to recipe imports.