Live › vulnerability › CVE-2026-111899
Go to dashboardKitchenOwl's recipe import fetches a second URL without the IP filter applied to the first request, so a crafted page can redirect or DNS-rebind the server to loopback, private-network or cloud-metadata addresses. An authenticated household member can use this to read internal services.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted KitchenOwl instances through where household members can import recipes from URLs. Instances with no outbound access to internal networks or cloud metadata have less to lose. Users of a managed instance they do not run can leave this to the operator.
0.7.10No product ranges from the sources yet.
0.7.10.0.7.10 once a fixed release is published; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that allows authenticated household members to bypass IP filtering via a second unfiltered fetch. Attackers can host a page titled KitchenOwl at a URL matching /recipe/<id>. The follow-up requests.get() call can then be redirected or DNS-rebound to loopback, private-network, or cloud-metadata addresses, exposing internal services.
This page as .md · .json · in your agent: get_signal("CVE-2026-111899")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.