{"id":"CVE-2026-59970","kind":"vulnerability","aliases":["CVE-2026-59970"],"related":[],"title":"Tandoor Recipes: AI provider URL lets users probe internal network hosts","description":"Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks when an authenticated user creates a Space, configures an AI provider with a URL targeting an internal address, and invokes an AI action. In cookbook/views/api.py, the affected AI actions call completion through TARGET/api/ai-import/ and api/ai-step-sort/ while bypassing safe_request. The attack works because the server connects to the supplied provider URL from each AI action and exposes connection success, refusal, or timeout as a blind network-reachability oracle. This can reach internal services, other hosts on the server network, and cloud metadata endpoints and map reachable internal hosts and ports. This issue is fixed in version 2.6.10.","summary":"Tandoor Recipes passes the administrator-set AI provider URL straight to LiteLLM without its outbound-request SSRF checks, in the AI import and AI step-sort actions. An authenticated user can use those actions to see whether internal hosts and ports accept connections, including cloud metadata endpoints.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-provider","ai-tooling","litellm","self-hosted","tandoor-recipes"],"not_affected_if":["no-ai-provider-configured","version-2.6.10-or-later"],"how_to_check":"- Check the installed Tandoor version; anything below `2.6.10` is affected.\n- Check whether an AI provider with a custom URL is configured in the Tandoor admin or Space settings.","fix":"- Upgrade Tandoor Recipes to `2.6.10` or later.\n- Until upgraded, remove the AI provider URL or restrict AI features to trusted users (unknown whether this is sufficient).","status":"open","published_at":"2026-10-16T20:17:23+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:14:19+00:00","updated_at":"2026-10-25T03:14:19+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-25T03:14:19Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Tandoor Recipes to `2.6.10` or later.\n- Until upgraded, remove the AI provider URL or restrict AI features to trusted users (unknown whether this is sufficient).","reach":"internet","title":"Tandoor Recipes: AI provider URL lets users probe internal network hosts","impact":"medium","summary":"Tandoor Recipes passes the administrator-set AI provider URL straight to LiteLLM without its outbound-request SSRF checks, in the AI import and AI step-sort actions. An authenticated user can use those actions to see whether internal hosts and ports accept connections, including cloud metadata endpoints.","category":"ai-tooling","nicknames":[],"who_cares":["tandoor-recipes","self-hosted","litellm","ai-provider"],"confidence":0.8,"needs_auth":"yes","worst_case":"Authenticated user maps internal network hosts and cloud metadata endpoints.","analyst_note":"","how_to_check":"- Check the installed Tandoor version; anything below `2.6.10` is affected.\n- Check whether an AI provider with a custom URL is configured in the Tandoor admin or Space settings.","needs_analyst":false,"not_affected_if":["version-2.6.10-or-later","no-ai-provider-configured"],"who_is_affected":"Self-hosted Tandoor Recipes installs before `2.6.10` that have an AI provider configured are exposed. The attack needs an authenticated account that can create a Space and run the AI actions, and the server must be able to reach internal addresses. Installs without an AI provider or on `2.6.10` or later can skip this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.001269,"input_tokens":3504,"output_tokens":1837,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-59970':14A,17A '2.6.10':97C,216C 'accept':75B 'action':60B,67B,141C,147C,173C 'address':136C 'administr':36B,101C 'administrator-control':100C 'administrator-set':35B 'affect':145C 'ai':3A,19B,22B,38B,53B,56B,103C,128C,140C,146C,172C 'ai-provid':18B 'ai-tool':21B 'api/ai-step-sort':153C 'appli':110C 'applic':85C 'attack':159C 'authent':62B,121C 'blind':183C 'build':92C 'bypass':155C 'call':148C 'check':50B,118C 'cloud':78B,200C 'complet':149C 'configur':126C 'connect':76B,164C,176C 'control':102C 'cookbook/views/api.py':143C 'creat':123C 'cve':12A,15A 'direct':106C 'endpoint':80B,202C 'expos':175C 'fix':213C 'host':11A,27B,72B,194C,207C 'import':54B 'includ':77B 'intern':9A,71B,135C,191C,206C 'invok':138C 'issu':211C 'let':6A 'list':94C 'litellm':24B,43B,108C 'manag':87C 'map':204C 'meal':90C 'metadata':79B,201C 'network':10A,185C,198C 'network-reach':184C 'oracl':187C 'outbound':47B,115C 'outbound-request':46B,114C 'pass':33B,98C 'plan':89C 'port':74B,209C 'prior':95C 'probe':8A 'provid':4A,20B,39B,104C,129C,168C 'reach':190C 'reachabl':186C,205C 'recip':2A,30B,32B,82C,88C 'refus':178C 'request':48B,116C,157C 'safe':156C 'see':69B 'self':26B 'self-host':25B 'server':112C,163C,197C 'servic':192C 'set':37B 'shop':93C 'sort':59B 'space':125C 'ssrf':49B,117C 'step':58B 'step-sort':57B 'straight':41B 'success':177C 'suppli':167C 'tandoor':1A,29B,31B,81C 'tandoor-recip':28B 'target':133C 'target/api/ai-import':151C 'timeout':180C 'tool':23B 'url':5A,40B,105C,132C,169C 'use':65B 'user':7A,63B,122C 'version':215C 'whether':70B 'without':44B,109C 'work':160C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Tandoor Recipes installs before `2.6.10` that have an AI provider configured are exposed. The attack needs an authenticated account that can create a Space and run the AI actions, and the server must be able to reach internal addresses. Installs without an AI provider or on `2.6.10` or later can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T20:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59970","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59970","severity":null,"published_at":"2026-10-16T20:17:23+00:00","modified_at":"2026-10-21T22:16:50+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}