CVE-2026-59970: Tandoor Recipes: SSRF via AI provider URL exposes internal network

HIGH

Published October 16, 2026

CISO Take

Tandoor Recipes before 2.6.10 lets any authenticated user point an AI provider URL at an internal address, and the server then connects to it without the SSRF checks it applies elsewhere. Responses are not returned, but connection success, refusal and timeout act as a blind oracle for mapping internal hosts and ports, and cloud metadata endpoints are reachable, which can lead to credential exposure. The scope change (S:C) and low privilege requirement make it a useful foothold for lateral reconnaissance. There is no EPSS score, no KEV listing, no public exploit and no Nuclei template, so mass exploitation is not currently indicated. Upgrade to 2.6.10 or later, and where patching is delayed, enforce IMDSv2 and egress filtering from the application host.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Rated high (CVSS 7.7). It is exploitable over the network with low complexity and low privileges, with no user interaction. Impact is confined to confidentiality and is blind (reachability signal only), but the scope change means it reaches resources outside the application's security boundary. Real exposure depends on whether the instance allows self-registration or Space creation and whether the host can reach metadata services or sensitive internal networks. There is no evidence of active exploitation, no public exploit and no KEV listing. Tandoor is a niche self-hosted app, so the AI/ML exposure is limited to its LLM integration feature.

How does the attack unfold?

Initial Access

Attacker authenticates with a low-privilege account and creates a Space.

AML.T0012

Exploitation

Attacker configures an AI provider with an internal URL and invokes an AI action that bypasses safe_request.

AML.T0049

Discovery

Attacker maps internal hosts, ports and metadata endpoints from connection success, refusal and timeout behavior.

AML.T0006

Impact

Internal topology and reachable cloud services are exposed, enabling targeted follow-on attacks.

AML.T0075

Initial Access

Attacker authenticates with a low-privilege account and creates a Space.

AML.T0012

Exploitation

Attacker configures an AI provider with an internal URL and invokes an AI action that bypasses safe_request.

AML.T0049

Discovery

Attacker maps internal hosts, ports and metadata endpoints from connection success, refusal and timeout behavior.

AML.T0006

Impact

Internal topology and reachable cloud services are exposed, enabling targeted follow-on attacks.

AML.T0075

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LiteLLM	pip	—	No patch
62.0KOpenSSF 6.0Pushed 6d ago51% patched~47d to patchFull package profile →

Do you use LiteLLM? You're affected.

How severe is it?

CVSS 3.1

7.7 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 24% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SChanged

CHigh

INone

ANone

What should I do?

5 steps

Upgrade Tandoor Recipes to 2.6.10 or later (commit 79e7835).
Until patched, disable AI features or restrict Space creation and AI provider configuration to trusted users.
Block outbound traffic from the application host to RFC1918 ranges, link-local 169.254.169.254 and other sensitive internal segments.
Enforce IMDSv2 (or the equivalent hop-limit protection) on cloud instances.
Monitor for AI provider configurations with internal or loopback URLs and for bursts of failed or timed-out outbound connections from the app host after calls to /api/ai-import/ and /api/ai-step-sort/.

How is it classified?

Data LeakageData ExtractionAPIInferenceFrameworkAML.T0006- Active Scanning AML.T0049- Exploit Public-Facing Application AML.T0075- Cloud Service Discovery

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to unknown risks and mechanisms to supersede or deactivate AI systems

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-59970?

Is CVE-2026-59970 actively exploited?

No confirmed active exploitation of CVE-2026-59970 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-59970?

1. Upgrade Tandoor Recipes to 2.6.10 or later (commit 79e7835). 2. Until patched, disable AI features or restrict Space creation and AI provider configuration to trusted users. 3. Block outbound traffic from the application host to RFC1918 ranges, link-local 169.254.169.254 and other sensitive internal segments. 4. Enforce IMDSv2 (or the equivalent hop-limit protection) on cloud instances. 5. Monitor for AI provider configurations with internal or loopback URLs and for bursts of failed or timed-out outbound connections from the app host after calls to /api/ai-import/ and /api/ai-step-sort/.

What systems are affected by CVE-2026-59970?

This vulnerability affects the following AI/ML architecture patterns: LLM gateway integrations, Self-hosted web applications with LLM features, Cloud-hosted AI-enabled services.

What is the CVSS score for CVE-2026-59970?

CVE-2026-59970 has a CVSS v3.1 base score of 7.7 (HIGH). The EPSS exploitation probability is 0.31%.

What is the AI security impact?

Affected AI Architectures

LLM gateway integrationsSelf-hosted web applications with LLM featuresCloud-hosted AI-enabled services

MITRE ATLAS Techniques

AML.T0006Active Scanning

AML.T0049Exploit Public-Facing Application

AML.T0075Cloud Service Discovery

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks when an authenticated user creates a Space, configures an AI provider with a URL targeting an internal address, and invokes an AI action. In cookbook/views/api.py, the affected AI actions call completion through TARGET/api/ai-import/ and api/ai-step-sort/ while bypassing safe_request. The attack works because the server connects to the supplied provider URL from each AI action and exposes connection success, refusal, or timeout as a blind network-reachability oracle. This can reach internal services, other hosts on the server network, and cloud metadata endpoints and map reachable internal hosts and ports. This issue is fixed in version 2.6.10.

Exploitation Scenario

An attacker registers or uses a low-privilege account, creates a Space and configures an AI provider whose URL targets an internal address such as http://169.254.169.254 or 10.0.0.x:port. They then call the AI import or step-sort action repeatedly across addresses and ports. They distinguish open, closed and filtered services from how quickly the connection succeeds, is refused or times out. The resulting internal map shows reachable services, including metadata endpoints and other hosts, which supports follow-on attacks against weaker internal systems.

Weaknesses (CWE)

CWE-918Server-Side Request Forgery (SSRF)Primary CWE-918Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.