CVE-2026-33148: Tandoor Recipes DoS Vulnerability

CVE-2026-33148 Overview

Tandoor Recipes, an application for managing recipes, planning meals, and building shopping lists, contains a URL parameter injection vulnerability in its FDC (USDA FoodData Central) search endpoint. In versions prior to 2.6.0, the endpoint constructs an upstream API URL by directly interpolating the user-supplied query parameter into the URL string without proper URL-encoding. This improper neutralization of special elements (CWE-74) allows attackers to inject additional URL parameters, override API keys, manipulate upstream query behavior, and cause server crashes resulting in a Denial of Service condition.

Critical Impact

Attackers can exploit this vulnerability to inject arbitrary URL parameters, manipulate API requests to external services, override authentication credentials, and crash the server with malformed requests causing service disruption.

Affected Products

• Tandoor Recipes versions prior to 2.6.0

Discovery Timeline

• 2026-03-26 - CVE CVE-2026-33148 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33148

Vulnerability Analysis

This vulnerability stems from improper input handling in the FDC search endpoint of Tandoor Recipes. The application integrates with the USDA FoodData Central API to provide nutritional information lookup functionality. When a user performs a search, the application constructs the upstream API request URL by directly concatenating the user-supplied query parameter without applying proper URL encoding.

The lack of input sanitization means that special characters, particularly the ampersand (&) character, are not escaped before being interpolated into the URL string. This allows an attacker to break out of the intended query parameter and inject additional parameters into the upstream API request.

The impact includes the ability to override the configured API key with an attacker-controlled value, manipulation of other query parameters to alter the behavior of upstream requests, and the potential to craft malformed requests that cause the server to return HTTP 500 errors, creating a Denial of Service condition.

Root Cause

The root cause is improper neutralization of special elements used in a downstream component (CWE-74). The application fails to URL-encode user input before interpolating it into an API URL string. When constructing URLs programmatically, all user-controlled values must be properly encoded to prevent special characters like &, =, and ? from being interpreted as URL structure delimiters rather than literal data.

Attack Vector

The attack is network-based and requires low privileges (authenticated access to the application). An attacker can craft a malicious search query containing & characters followed by additional parameter key-value pairs. When this query is processed, the injected parameters become part of the upstream API request.

For example, a query value like chicken&api_key=attacker_key&extra_param=value would result in the attacker's parameters being appended to the legitimate API URL, potentially overriding the application's configured API key or adding arbitrary parameters to the request. Malformed injections can cause request processing failures resulting in HTTP 500 errors, enabling Denial of Service attacks against the application.

Detection Methods for CVE-2026-33148

Indicators of Compromise

• Unusual search queries containing & characters followed by parameter patterns in application logs
• Elevated HTTP 500 error rates on FDC search endpoints
• API request logs showing unexpected or duplicate parameters
• Upstream API rate limiting or blocking due to malformed requests

Detection Strategies

• Monitor application logs for search queries containing URL special characters (&, =, ?)
• Implement web application firewall (WAF) rules to detect parameter injection patterns in query strings
• Set up alerting for abnormal error rates on the FDC search endpoint
• Review upstream API access logs for unusual request patterns or authentication failures

Monitoring Recommendations

• Enable detailed request logging for the FDC search functionality
• Configure alerting thresholds for HTTP 500 errors originating from search endpoints
• Monitor for repeated failed requests from single IP addresses that may indicate exploitation attempts
• Track upstream API error responses for anomalies

How to Mitigate CVE-2026-33148

Immediate Actions Required

• Upgrade Tandoor Recipes to version 2.6.0 or later immediately
• If upgrade is not immediately possible, consider temporarily disabling the FDC search feature
• Review application logs for signs of prior exploitation attempts
• Implement rate limiting on the affected endpoint as an interim measure

Patch Information

Version 2.6.0 of Tandoor Recipes patches this vulnerability by implementing proper URL encoding for user-supplied query parameters before constructing upstream API URLs. Users should upgrade to this version or later to remediate the issue. For detailed information about the fix, refer to the GitHub Security Advisory.

Workarounds

• Temporarily disable or restrict access to the FDC search functionality until the patch can be applied
• Implement a web application firewall (WAF) rule to block requests containing & characters in the search query parameter
• Use network-level access controls to limit who can access the vulnerable endpoint
• Deploy a reverse proxy with input validation to sanitize requests before they reach the application