CVE-2026-23838: Tandoor Recipes Information Disclosure

CVE-2026-23838 Overview

CVE-2026-23838 is a Sensitive Data Exposure vulnerability affecting Tandoor Recipes when installed via the Nix package manager. The vulnerability stems from an insecure default configuration in the NixOS module that causes the SQLite database file to be placed in the same directory as media files, making it accessible without authentication over HTTP.

When using the default configuration of Tandoor Recipes with SQLite and the default MEDIA_ROOT setting, the full database file (db.sqlite3) becomes externally accessible, potentially exposing it to the Internet. This occurs because the NixOS module configures both the working directory and MEDIA_ROOT to /var/lib/tandoor-recipes, causing the database to be served like any other media file.

Critical Impact

The entire SQLite database containing recipe data, user credentials, and application configuration can be downloaded by unauthenticated attackers over the network, leading to complete data exposure.

Affected Products

• Tandoor Recipes (NixOS package) versions 23.05 through prior to 26.05
• NixOS configurations with system.stateVersion < 26.05
• Deployments using GUNICORN_MEDIA=1 or nginx serving media files

Discovery Timeline

• 2026-01-19 - CVE CVE-2026-23838 published to NVD
• 2026-01-19 - Last updated in NVD database

Technical Details for CVE-2026-23838

Vulnerability Analysis

This vulnerability is classified under CWE-538 (Insertion of Sensitive Information into Externally-Accessible File or Directory). The core issue is a configuration flaw in how the NixOS module sets up Tandoor Recipes, resulting in the SQLite database being inadvertently exposed through the web server.

The exploitation scenario requires no authentication and can be performed remotely over the network. An attacker simply needs to request the db.sqlite3 file through HTTP, and if the vulnerable configuration is in place, the entire database will be served as if it were a regular media file such as an image or document.

The exposed database potentially contains sensitive information including user account details, hashed passwords, recipe data, API tokens, and any other application data stored by Tandoor Recipes.

Root Cause

The NixOS module for Tandoor Recipes configures the working directory to /var/lib/tandoor-recipes and also sets MEDIA_ROOT to the same location. When Tandoor Recipes initializes, it creates its db.sqlite3 database file in the working directory. Because MEDIA_ROOT points to the same directory, the web server (either Gunicorn with GUNICORN_MEDIA=1 or an external server like nginx configured to serve media) treats the database file as accessible static content.

This design oversight means any file in the working directory, including the sensitive database, becomes publicly accessible through HTTP requests without any authentication checks.

Attack Vector

The attack vector is network-based and requires no user interaction or prior authentication. An attacker can exploit this vulnerability by:

1. Identifying a Tandoor Recipes instance running on NixOS with the vulnerable default configuration
2. Sending an HTTP request to the media endpoint requesting the db.sqlite3 file
3. Downloading the complete SQLite database containing all application data

The vulnerability is particularly severe because the database file includes all stored information: user credentials (including password hashes), recipe content, configuration settings, and potentially API tokens or session data.

Detection Methods for CVE-2026-23838

Indicators of Compromise

• Unusual HTTP requests targeting /media/db.sqlite3 or similar paths attempting to access the database file
• Web server access logs showing successful downloads of .sqlite3 files from the media directory
• Large data transfers from the media endpoint that match the size of the SQLite database
• External reconnaissance activity probing for common database filenames in web-accessible directories

Detection Strategies

• Monitor web server access logs for requests containing db.sqlite3 or *.sqlite* patterns in the URL path
• Implement file integrity monitoring on the /var/lib/tandoor-recipes/ directory to detect unauthorized access
• Configure web application firewalls to alert on requests attempting to access database file extensions
• Review nginx or Gunicorn configuration to verify database files are not being served

Monitoring Recommendations

• Set up alerts for any HTTP 200 responses to requests for SQLite database files
• Monitor outbound data transfer volumes from the Tandoor Recipes media endpoint for anomalies
• Implement periodic configuration audits to ensure MEDIA_ROOT is properly isolated from the working directory
• Review authentication logs for suspicious activity following potential database exposure

How to Mitigate CVE-2026-23838

Immediate Actions Required

• Verify your NixOS system.stateVersion and Tandoor Recipes configuration to determine exposure
• Check if MEDIA_ROOT is set to the same directory as the application working directory
• Audit web server logs for any historical access to db.sqlite3 or similar database files
• If exposure is confirmed, rotate all user credentials and API tokens stored in the database

Patch Information

NixOS 26.05 addresses this vulnerability by changing the default value of MEDIA_ROOT to a subdirectory of the data directory, preventing the database from being served as media content. This fix only applies automatically to configurations with system.stateVersion >= 26.05.

NixOS 25.11 has received a backport of this patch, but it requires manual user intervention to take effect for existing configurations. Administrators should review the GitHub Pull Request #427845 and GitHub Pull Request #481140 for implementation details.

For more information, see the GitHub Security Advisory GHSA-g8w3-p77x-mmxh and the original GitHub Issue #338339.

Workarounds

• Recommended: Move MEDIA_ROOT to a subdirectory (e.g., /var/lib/tandoor-recipes/media/) to isolate media files from the database
• Alternative: Switch from SQLite to PostgreSQL, which stores data outside the web-accessible directory
• Alternative: Configure web server rules to explicitly disallow access to db.sqlite3 and other database files
• Add deny rules in nginx configuration to block requests for .sqlite3 file extensions

# Configuration example - nginx deny rule for SQLite files
# Add to your nginx server block for Tandoor Recipes

location ~ \.sqlite3$ {
    deny all;
    return 403;
}

# Or configure MEDIA_ROOT to use a subdirectory in your NixOS configuration
# services.tandoor-recipes.settings.MEDIA_ROOT = "/var/lib/tandoor-recipes/media";