CVE-2026-59970: Tandoor Recipes SSRF Vulnerability

CVE-2026-59970 Overview

CVE-2026-59970 is a Server-Side Request Forgery (SSRF) vulnerability in Tandoor Recipes, an open-source application for managing recipes, planning meals, and building shopping lists. Versions prior to 2.6.10 pass an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks. An authenticated user who can create a Space and configure an AI provider can target internal addresses through the AI import and AI step-sort actions. The flaw is tracked as [CWE-918] Server-Side Request Forgery and was fixed in version 2.6.10.

Critical Impact
Authenticated attackers can probe internal services, hosts on the server's internal network, and cloud metadata endpoints by using connection success, refusal, or timeout as a blind network-reachability oracle.

Affected Products

Tandoor Recipes versions prior to 2.6.10
Deployments exposing the api/ai-import/ endpoint
Deployments exposing the api/ai-step-sort/ endpoint

Discovery Timeline

2026-10-16 - CVE-2026-59970 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-59970

Vulnerability Analysis

The vulnerability exists in cookbook/views/api.py, where AI actions invoke LiteLLM's completion function using an administrator-supplied provider URL. The affected code paths route requests through TARGET/api/ai-import/ and api/ai-step-sort/ without passing through the application's safe_request wrapper. That wrapper is responsible for enforcing outbound-request SSRF protections, including validation of destination hosts.

Because safe_request is bypassed, the Tandoor server initiates HTTP connections to arbitrary URLs supplied in Space-level AI provider configuration. Each AI action exposes whether the request succeeded, was refused, or timed out, creating a blind reachability oracle for the attacker.

Root Cause

The root cause is missing destination validation on an outbound HTTP request path. The AI provider URL is treated as trusted administrator input and forwarded to the LiteLLM client. No allow-list, deny-list, or private-IP filter is applied before the request leaves the server, allowing attacker-controlled destinations including 127.0.0.1, RFC1918 ranges, and the cloud metadata address 169.254.169.254.

Attack Vector

An authenticated user creates a Space, configures a custom AI provider with a URL pointing at an internal target, then triggers an AI action such as AI import or AI step sort. The server connects to the configured URL from its own network position. Response signals allow the attacker to enumerate reachable internal hosts and open ports.

python

# Patch excerpt from cookbook/views/api.py (fixed in 2.6.10)
from cookbook.version_info import TANDOOR_VERSION
from cookbook.views.import_export import get_integration
from recipes import settings
-from recipes.settings import DRF_THROTTLE_RECIPE_URL_IMPORT, FDC_API_KEY, AI_RATELIMIT
+from recipes.settings import DRF_THROTTLE_RECIPE_URL_IMPORT, FDC_API_KEY, AI_RATELIMIT, AI_ALLOWED_URLS

Source: GitHub Commit 79e7835

The fix introduces an AI_ALLOWED_URLS allow-list that constrains which provider URLs can be used by AI actions.

Detection Methods for CVE-2026-59970

Indicators of Compromise

Outbound requests from the Tandoor application host to RFC1918 addresses, 127.0.0.0/8, or 169.254.169.254 originating from AI action handlers.
Space configuration changes creating custom AI providers whose URLs point to internal hostnames or IP literals.
Repeated calls to api/ai-import/ or api/ai-step-sort/ from a single authenticated session with varying provider URLs.

Detection Strategies

Inspect application logs for AI provider configurations containing private IP ranges, loopback, or link-local addresses.
Correlate completion-triggered outbound connections with HTTP response patterns consistent with port scanning (short, uniform timings).
Alert on any outbound HTTP request from the Tandoor service account to cloud metadata endpoints.

Monitoring Recommendations

Capture egress NetFlow or VPC flow logs for the Tandoor host and baseline normal destinations.
Enable audit logging on Space creation and AI provider updates, and forward to a central SIEM.
Monitor the frequency of AI actions per user against the configured AI_RATELIMIT to detect oracle-style probing.

How to Mitigate CVE-2026-59970

Immediate Actions Required

Upgrade Tandoor Recipes to version 2.6.10 or later without delay.
Configure the new AI_ALLOWED_URLS environment variable to restrict AI provider destinations to known-good hosts.
Audit existing Spaces for custom AI provider URLs that target internal or metadata addresses and remove them.

Patch Information

The fix is included in Tandoor Recipes Release 2.6.10 and the corresponding commit 79e7835. Details are published in GitHub Security Advisory GHSA-wq4h-2r8x-cv65.

Workarounds

Place the Tandoor service behind an egress proxy that blocks RFC1918, loopback, and 169.254.169.254 destinations.
Restrict Space creation and AI provider configuration to trusted administrators only.
Disable AI import and AI step-sort features until the upgrade is applied if an egress control cannot be enforced.

bash

# Example: constrain AI provider destinations in 2.6.10+
export AI_ALLOWED_URLS="https://api.openai.com,https://api.anthropic.com"