{"id":"CVE-2026-115810","kind":"vulnerability","aliases":["CVE-2026-115810"],"related":[],"title":"Tandoor Recipes: Pestle importer lets users make server fetch internal URLs","description":"Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to issue GET requests to arbitrary internal or external hosts by crafting a malicious image URL in a Pestle JSON import file. Attackers can exploit the raw requests.get call in cookbook/integration/pestle.py, which bypasses the application's centralized requests-hardened SSRF filter, to reach internal-only endpoints, perform port/service discovery, and exfiltrate internal responses via the stored recipe image.","summary":"Tandoor Recipes before 2.7.0 has a server-side request forgery flaw in its Pestle JSON importer, which calls requests.get directly and skips the app's SSRF filter. An authenticated low-privilege user can make the server fetch internal or external hosts through a crafted image URL and read the responses back through the stored recipe image.","severity":"high","cvss":7.7,"epss":0.00426,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["django","package","python","self-hosted","tandoor-recipes"],"not_affected_if":["no-internal-network-access","version-2.7.0-or-later"],"how_to_check":"- Check the installed Tandoor Recipes version; unknown whether a fixed build tag is listed in the sources beyond `2.7.0`\n- Look for the Pestle importer code at `cookbook/integration/pestle.py` and whether it calls `requests.get` directly","fix":"- Upgrade Tandoor Recipes to `2.7.0` or later\n- Until upgraded, unknown whether disabling the Pestle importer or restricting import permissions is a supported mitigation","status":"open","published_at":"2026-10-23T17:17:21+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:10:24+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:10:24Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Tandoor Recipes to `2.7.0` or later\n- Until upgraded, unknown whether disabling the Pestle importer or restricting import permissions is a supported mitigation","reach":"network","title":"Tandoor Recipes: Pestle importer lets users make server fetch internal URLs","impact":"medium","summary":"Tandoor Recipes before 2.7.0 has a server-side request forgery flaw in its Pestle JSON importer, which calls requests.get directly and skips the app's SSRF filter. An authenticated low-privilege user can make the server fetch internal or external hosts through a crafted image URL and read the responses back through the stored recipe image.","category":"package","nicknames":[],"who_cares":["tandoor-recipes","self-hosted","python","django"],"confidence":0.7,"needs_auth":"yes","worst_case":"Server fetches internal endpoints and leaks responses via recipe image","analyst_note":"Confirm the exact affected version range and whether a patch or mitigation beyond upgrading to 2.7.0 exists; check the NVD entry and the Tandoor release notes.","how_to_check":"- Check the installed Tandoor Recipes version; unknown whether a fixed build tag is listed in the sources beyond `2.7.0`\n- Look for the Pestle importer code at `cookbook/integration/pestle.py` and whether it calls `requests.get` directly","needs_analyst":true,"not_affected_if":["version-2.7.0-or-later","no-internal-network-access"],"who_is_affected":"Self-hosted Tandoor Recipes instances before 2.7.0 where users can import Pestle JSON files. The exposure depends on the server being able to reach internal networks or services, which is common for self-hosted deployments. Instances on 2.7.0 or later, or hosted deployments with no internal network reach, have less exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000682,"input_tokens":3419,"output_tokens":680,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115810':14A,17A '-2026':13A,16A '2.7.0':30B,88C 'allow':102C 'app':51B 'applic':146C 'arbitrari':117C 'attack':134C 'authent':56B,103C 'back':79B 'bypass':144C 'call':45B,140C 'central':148C 'contain':89C 'cookbook/integration/pestle.py':142C 'craft':72B,123C 'cve':12A,15A 'direct':47B 'discoveri':162C 'django':18B 'endpoint':159C 'exfiltr':164C 'exploit':136C 'extern':68B,120C 'fetch':9A,65B 'file':133C 'filter':54B,153C 'flaw':38B 'forc':109C 'forgeri':37B,95C 'get':114C 'harden':151C 'host':23B,69B,121C 'imag':73B,84B,126C,171C 'import':4A,43B,100C,132C 'intern':10A,66B,118C,157C,165C 'internal-on':156C 'issu':113C 'json':42B,131C 'let':5A 'low':58B,105C 'low-privileg':57B,104C 'make':7A,62B 'malici':125C 'packag':19B 'perform':160C 'pestl':3A,41B,99C,130C 'port/service':161C 'privileg':59B,106C 'python':20B 'raw':138C 'reach':155C 'read':76B 'recip':2A,26B,28B,83B,86C,170C 'request':36B,94C,115C,150C 'requests-harden':149C 'requests.get':46B,139C 'respons':78B,166C 'self':22B 'self-host':21B 'server':8A,34B,64B,92C,111C 'server-sid':33B,91C 'side':35B,93C 'skip':49B 'ssrf':53B,152C 'store':82B,169C 'tandoor':1A,25B,27B,85C 'tandoor-recip':24B 'url':11A,74B,127C 'user':6A,60B,107C 'via':167C 'vulner':96C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Tandoor Recipes instances before 2.7.0 where users can import Pestle JSON files. The exposure depends on the server being able to reach internal networks or services, which is common for self-hosted deployments. Instances on 2.7.0 or later, or hosted deployments with no internal network reach, have less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T17:17:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115810","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115810","severity":null,"published_at":"2026-10-23T17:17:21+00:00","modified_at":"2026-10-23T19:57:42+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115810","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115810","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}