CVE-2026-115810

Name of the Vulnerable Software and Affected Versions Tandoor Recipes versions prior to 2.7.0

Description The Pestle importer contains a server-side request forgery (SSRF) issue, which occurs when a server is tricked into making requests to an unintended location. Authenticated low-privileged users can force the server to issue GET requests to arbitrary internal or external hosts by crafting a malicious image URL within a Pestle JSON import file. This is possible because the requests.get() function in cookbook/integration/pestle.py bypasses the centralized SSRF filter, allowing attackers to access internal-only endpoints, perform port and service discovery, and exfiltrate internal responses through the stored recipe image.

Recommendations Update to version 2.7.0 or later.