CVE-2026-25991

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25991", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-09T17:41:55.858Z", "datePublished": "2026-02-13T18:29:10.900Z", "dateUpdated": "2026-02-13T19:58:00.752Z"}, "containers": {"cna": {"title": "Tandoor Recipes affected by Blind SSRF with Internal Network Access via Recipe Import", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-j6xg-85mh-qqf7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-j6xg-85mh-qqf7"}, {"name": "https://github.com/TandoorRecipes/recipes/commit/fdf22c5e745740db1fec29d6b4bd3df5d340e6ab", "tags": ["x_refsource_MISC"], "url": "https://github.com/TandoorRecipes/recipes/commit/fdf22c5e745740db1fec29d6b4bd3df5d340e6ab"}, {"name": "https://github.com/TandoorRecipes/recipes/releases/tag/2.5.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/TandoorRecipes/recipes/releases/tag/2.5.1"}], "affected": [{"vendor": "TandoorRecipes", "product": "recipes", "versions": [{"version": "< 2.5.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-13T18:29:10.900Z"}, "descriptions": [{"lang": "en", "value": "Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, there is a Blind Server-Side Request Forgery (SSRF) vulnerability in the Cookmate recipe import feature of Tandoor Recipes. The application fails to validate the destination URL after following HTTP redirects, allowing any authenticated user (including standard users without administrative privileges) to force the server to connect to arbitrary internal or external resources. The vulnerability lies in cookbook/integration/cookmate.py, within the Cookmate integration class. This vulnerability can be leveraged to scan internal network ports, access cloud instance metadata (e.g., AWS/GCP Metadata Service), or disclose the server's real IP address. This vulnerability is fixed in 2.5.1."}], "source": {"advisory": "GHSA-j6xg-85mh-qqf7", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-13T19:56:39.825139Z", "id": "CVE-2026-25991", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-13T19:58:00.752Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25991", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-09T17:41:55.858Z", "datePublished": "2026-02-13T18:29:10.900Z", "dateUpdated": "2026-02-13T19:58:00.752Z"}, "containers": {"cna": {"title": "Tandoor Recipes affected by Blind SSRF with Internal Network Access via Recipe Import", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-j6xg-85mh-qqf7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-j6xg-85mh-qqf7"}, {"name": "https://github.com/TandoorRecipes/recipes/commit/fdf22c5e745740db1fec29d6b4bd3df5d340e6ab", "tags": ["x_refsource_MISC"], "url": "https://github.com/TandoorRecipes/recipes/commit/fdf22c5e745740db1fec29d6b4bd3df5d340e6ab"}, {"name": "https://github.com/TandoorRecipes/recipes/releases/tag/2.5.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/TandoorRecipes/recipes/releases/tag/2.5.1"}], "affected": [{"vendor": "TandoorRecipes", "product": "recipes", "versions": [{"version": "< 2.5.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-13T18:29:10.900Z"}, "descriptions": [{"lang": "en", "value": "Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, there is a Blind Server-Side Request Forgery (SSRF) vulnerability in the Cookmate recipe import feature of Tandoor Recipes. The application fails to validate the destination URL after following HTTP redirects, allowing any authenticated user (including standard users without administrative privileges) to force the server to connect to arbitrary internal or external resources. The vulnerability lies in cookbook/integration/cookmate.py, within the Cookmate integration class. This vulnerability can be leveraged to scan internal network ports, access cloud instance metadata (e.g., AWS/GCP Metadata Service), or disclose the server's real IP address. This vulnerability is fixed in 2.5.1."}], "source": {"advisory": "GHSA-j6xg-85mh-qqf7", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25991", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-13T19:56:39.825139Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-13T19:57:16.651Z"}}]}}

{"affected": [{"affectedData": [{"product": "recipes", "vendor": "TandoorRecipes", "versions": [{"status": "affected", "version": "< 2.5.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tandoor:recipes:*:*:*:*:*:*:*:*", "matchCriteriaId": "21860AB5-9F47-4015-958B-26FE480AE53B", "versionEndExcluding": "2.5.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, there is a Blind Server-Side Request Forgery (SSRF) vulnerability in the Cookmate recipe import feature of Tandoor Recipes. The application fails to validate the destination URL after following HTTP redirects, allowing any authenticated user (including standard users without administrative privileges) to force the server to connect to arbitrary internal or external resources. The vulnerability lies in cookbook/integration/cookmate.py, within the Cookmate integration class. This vulnerability can be leveraged to scan internal network ports, access cloud instance metadata (e.g., AWS/GCP Metadata Service), or disclose the server's real IP address. This vulnerability is fixed in 2.5.1."}, {"lang": "es", "value": "Tandoor Recipes es una aplicaci\u00f3n para gestionar recetas, planificar comidas y crear listas de la compra. Antes de la versi\u00f3n 2.5.1, existe una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) ciega en la funci\u00f3n de importaci\u00f3n de recetas de Cookmate de Tandoor Recipes. La aplicaci\u00f3n no valida la URL de destino despu\u00e9s de seguir redirecciones HTTP, permitiendo a cualquier usuario autenticado (incluidos usuarios est\u00e1ndar sin privilegios administrativos) forzar al servidor a conectarse a recursos internos o externos arbitrarios. La vulnerabilidad reside en cookbook/integration/cookmate.py, dentro de la clase de integraci\u00f3n de Cookmate. Esta vulnerabilidad puede ser explotada para escanear puertos de red internos, acceder a metadatos de instancias en la nube (por ejemplo, Servicio de Metadatos de AWS/GCP) o revelar la direcci\u00f3n IP real del servidor. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.5.1."}], "id": "CVE-2026-25991", "lastModified": "2026-06-17T10:25:33.520", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25991", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-13T19:56:39.825139Z", "version": "2.0.3"}}]}, "published": "2026-02-13T19:17:28.953", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/TandoorRecipes/recipes/commit/fdf22c5e745740db1fec29d6b4bd3df5d340e6ab"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/TandoorRecipes/recipes/releases/tag/2.5.1"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-j6xg-85mh-qqf7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.5.1)"}}], "product": "recipes", "vendor": "tandoorrecipes"}], "analysis": {"en": {"generated_at": "2026-04-18T12:29:39.885599+00:00", "value": {"mitigation_remediation": ["Apply the latest patch (upgrade to Tandoor Recipes 2.5.1 or later) to fix the SSRF flaw.", "Restrict outbound network connections from the Tandoor Recipes server to only the services required by the application, limiting the reach of any residual SSRF.", "Temporarily disable the Cookmate recipe import feature until the application can be upgraded to a fixed version, preventing authenticated users from triggering SSRF."], "summary": {"action": "Patch", "impact": "Blind SSRF allowing internal network access"}, "threat_synthesis": {"affected_systems": "All releases of Tandoor Recipes prior to version 2.5.1 are affected. The fix was introduced in the 2.5.1 release (see the commit fdf22c5e745740db1fec29d6b4bd3df5d340e6ab and the 2.5.1 tag). Users running any earlier 2.x series, or earlier, are vulnerable.", "description_and_impact": "The Cookmate recipe import feature in Tandoor Recipes permits a blind server\u2011side request forgery because the application does not validate the final destination URL after HTTP redirects. Any authenticated user, even a standard user without administrative rights, can force the server to send requests to arbitrary internal or external resources. This flaw can be used to probe internal network ports, capture cloud instance metadata services such as AWS or GCP metadata, or reveal the host\u2019s real IP address. The vulnerability falls under CWE\u2011918, representing an unvalidated redirect or forwarding flaw that compromises confidentiality and availability of internal resources.", "risk_and_exploitability": "The CVSS v3.1 score is 7.7, indicating a high severity impact. The EPSS score is reported as less than 1%, suggesting a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated to the application, but once logged in they can supply any URL for import, making the attack path straightforward. The potential damage includes unauthorized network reconnaissance, metadata theft, and server IP disclosure, which could aid further attacks against the host."}}}}, "created": "2026-02-13T21:28:27.914709+00:00", "updated": "2026-04-18T12:30:45.483133+00:00", "vendors": ["tandoorrecipes", "tandoorrecipes$PRODUCT$recipes"]}