CVE-2026-115810: Server-Side Request Forgery (SSRF) in TandoorRecipes recipes

CVE-2026-115810 is a server-side request forgery vulnerability in Tandoor Recipes before version 2.7.0, specifically in the Pestle importer component. Authenticated users with low privileges can exploit this by embedding malicious image URLs in Pestle JSON import files. The vulnerability stems from the use of a raw requests.get call in cookbook/integration/pestle.py, which circumvents the application's centralized SSRF filter. This allows attackers to make the server send GET requests to arbitrary internal or external hosts, potentially reaching internal-only endpoints, conducting port and service discovery, and exfiltrating internal responses through stored recipe images.

An attacker with authenticated low-privileged access can exploit this SSRF vulnerability to make the server perform unauthorized GET requests to arbitrary hosts, including internal network endpoints. This can lead to information disclosure such as internal service details and responses, potentially aiding further attacks or reconnaissance. The vulnerability does not require user interaction beyond authentication and does not escalate privileges directly but can expose sensitive internal network information.

No explicit patch or remediation is stated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Pestle importer functionality to trusted users only and monitor for suspicious import activity. Avoid importing untrusted Pestle JSON files containing image URLs.