CVE-2026-115810 Tandoor Recipes before 2.7.0 SSRF via Pestle Importer Image URL
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-115810?
CVE-2026-115810 is a medium-severity vulnerability in TandoorRecipes recipes, published on 23 Oct 2026.
Official description
Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to issue GET requests to arbitrary internal or external hosts by crafting a malicious image URL in a Pestle JSON import file. Attackers can exploit the raw requests.get call in cookbook/integration/pestle.py, which bypasses the application's centralized requests-hardened SSRF filter, to reach internal-only endpoints, perform port/service discovery, and exfiltrate internal responses via the stored recipe image.
Weakness: CWE-918
Which versions are affected by CVE-2026-115810?
How do I fix CVE-2026-115810?
No fix has been published for CVE-2026-115810 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-115810 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-115810 exists.
Sources
Also known as GHSA-2rvv-3hmc-xc55, GHSA-xq7g-9q95-vjc6.