Tandoor Recipes EUVD-2026-103145

Requires an authenticated Tandoor account with privileges to create a Space and configure an AI provider URL, then trigger an AI action routed through the TARGET/api/ai-import/ or api/ai-step-sort/ code paths, which in versions prior to 2.6.10 call LiteLLM completion while bypassing the server's safe_request outbound SSRF filter. The decisive limiting factors are: (1) authentication is mandatory (PR:L) - this is not remote-unauthenticated; (2) the AI provider feature must be in use and the attacker must control the provider URL within their Space; and (3) the result is a blind reachability oracle only (connection success/refusal/timeout), not full response-body exfiltration, so direct secret theft from metadata endpoints is not confirmed. Post-fix, exploitation also requires the target URL to be absent from the operator-defined AI_ALLOWED_URLS allowlist, which defaults to empty.

This is a legitimate but moderate-priority issue, best characterized as an authenticated blind SSRF oracle rather than a high-urgency remote code execution flaw. The vendor CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7 HIGH) correctly reflects network reachability, low attack complexity, and the scope change (S:C) that lets the vulnerable web app probe other systems - but the C:H rating appears generous given the description explicitly states the attacker only receives a blind oracle (connection success, refusal, or timeout) and cannot read response bodies, so actual data disclosure is limited to internal host/port reachability mapping. Critically, PR:L confirms this requires an authenticated account, meaningfully narrowing the attacker population versus an unauthenticated internet-facing bug. No EPSS score, CISA KEV listing, or public exploit was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; exploitation is plausible but currently theoretical. The strongest mitigating signal is the deployment profile: Tandoor is a self-hosted recipe manager, typically run by homelab/hobbyist users behind their own networks rather than in large enterprise fleets, so blast radius is inherently limited. Net: patch when convenient, but this is not a drop-everything issue unless you run Tandoor with untrusted authenticated users who can configure AI providers and your server sits adjacent to sensitive internal services or cloud metadata endpoints.

An authenticated Tandoor user (AV:N/PR:L) creates a Space, configures an AI provider pointing its URL at an internal target such as http://169.254.169.254/ or an internal host:port, then invokes an AI action (ai-import or ai-step-sort). The server connects outbound to that URL from the AI action without applying its safe_request SSRF checks, and the differing responses (success, connection refused, or timeout) act as a blind oracle to map which internal hosts and ports are reachable. No public exploit code was identified at time of analysis, though the mechanism is straightforward to reproduce from the advisory and commit.