Live › vulnerability › CVE-2026-115810
Go to dashboardTandoor Recipes before 2.7.0 has a server-side request forgery flaw in its Pestle JSON importer, which calls requests.get directly and skips the app's SSRF filter. An authenticated low-privilege user can make the server fetch internal or external hosts through a crafted image URL and read the responses back through the stored recipe image.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted Tandoor Recipes instances before 2.7.0 where users can import Pestle JSON files. The exposure depends on the server being able to reach internal networks or services, which is common for self-hosted deployments. Instances on 2.7.0 or later, or hosted deployments with no internal network reach, have less exposure.
No product ranges from the sources yet.
2.7.0cookbook/integration/pestle.py and whether it calls requests.get directly2.7.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to issue GET requests to arbitrary internal or external hosts by crafting a malicious image URL in a Pestle JSON import file. Attackers can exploit the raw requests.get call in cookbook/integration/pestle.py, which bypasses the application's centralized requests-hardened SSRF filter, to reach internal-only endpoints, perform port/service discovery, and exfiltrate internal responses via the stored recipe image.
This page as .md · .json · in your agent: get_signal("CVE-2026-115810")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.