Tandoor Recipes EUVD-2026-109097

Requires a valid authenticated account holding only the standard space 'user' role (no admin) and access to the Pestle import endpoint POST /api/import/ with type=PESTLE - a default-available feature present since v2.6.15. The attacker controls the image URL field inside the uploaded Pestle JSON. The limiting factors are: (1) authentication is mandatory (PR:L - a low-privileged token/account must be obtained first), and (2) the read channel is constrained to responses that are stored and retrievable as a recipe image, so exfiltration favors image-parseable internal responses, though blind port/service discovery and reaching internal/metadata endpoints work regardless. No user interaction by a victim is required. Real-world severity rises sharply when Tandoor runs in a cloud environment where 169.254.169.254 instance metadata is reachable.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation, but PR:L means it requires an authenticated low-privileged account - a meaningful barrier against anonymous mass exploitation. The scored impact is confined to subsequent systems (SC:H, with VC/VI/VA all N on the Tandoor host itself), which correctly captures SSRF: the Tandoor app is not directly compromised, but it becomes a pivot to internal services and cloud metadata. The vuln.today Decision label is 'this_month' (not act_now/emergency), aligning with the 6.3 base score. No EPSS score and no CISA KEV entry were supplied, so there is no evidence of active or widespread exploitation - exploitation status is 'no public exploit identified' in the strict KEV/POC-feed sense, HOWEVER the vendor GHSA advisory (GHSA-xq7g-9q95-vjc6) contains a complete working PoC that the reporter states was reproduced twice, so a functional proof-of-concept is public. Net: treat as a schedule-this-month patch, elevated if the Tandoor instance runs in a cloud environment with reachable instance-metadata (169.254.169.254) or sits adjacent to sensitive internal networks, since that is where SC:H becomes materially dangerous.

An attacker with only a standard low-privileged Tandoor 'user' account crafts a malicious .pestle import file whose recipe image URL points at an internal target (e.g. http://127.0.0.1:8899/ or the cloud metadata endpoint), then POSTs it to /api/import/ with type=PESTLE. The server fetches that URL via the unhardened requests.get call and stores the fetched internal response as the recipe image, letting the attacker perform internal port/service discovery and exfiltrate image-parseable internal responses. A complete, reporter-reproduced PoC is published in the vendor's GHSA advisory.