Tandoor Recipes CVE-2026-59966

Exploitation requires an authenticated account that is a member of a shared Space and the ability to create an Automation rule (specifically a regex-replace or transpose rule whose pattern populates Automation.param_2). The denial of service only triggers when a second user in the same Space imports a recipe via the api/recipe-from-source/ endpoint whose source text matches the malicious pattern (processed through apply_regex_replace_automation and re.sub), so attacker-stored-plus-victim-import interaction is mandatory (UI:R). Limiting factors: valid authentication and shared-Space membership are prerequisites, so single-user or fully trusted deployments are not meaningfully exposed; impact is limited to temporary Gunicorn worker exhaustion bounded by the request timeout, with no data exposure or code execution. Affected versions are prior to 2.6.10.

This is a moderate-severity denial-of-service issue (ReDoS / CWE-1333), not a critical priority. The vendor CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H scores 5.7 and is internally consistent with the description: exploitation requires an authenticated user (PR:L) who shares a Space, the trigger depends on a second user importing a matching recipe (UI:R), and impact is confined to availability (A:H) with no confidentiality or integrity loss (C:N/I:N). No EPSS score was provided in the input, and the vulnerability is NOT listed in CISA KEV; no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. No SSVC decision data was supplied. The signals are mutually consistent and all point toward a low-urgency, insider/abuse-of-trust DoS rather than an internet-wide mass-exploitation threat: an attacker must already hold valid authenticated access to a shared Space, and the disruption is temporary worker exhaustion rather than code execution or data compromise. Prioritize patching for multi-tenant or shared-Space deployments; single-user or trusted-team instances carry materially lower real-world risk.

An authenticated member of a shared Tandoor Space creates an Automation rule containing a catastrophic-backtracking regular expression (e.g., a nested-quantifier pattern) in its param_2 field. When any other user in that Space imports a recipe whose source text matches the pattern, the api/recipe-from-source/ endpoint evaluates the regex via Python re.sub() with no timeout, pinning a Gunicorn worker until the request timeout fires. Repeated imports exhaust all worker slots and render the service unavailable. No public exploit code is referenced in the provided data.