Recipes EUVD-2026-16311

The CVSS v3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates this is a network-accessible denial of service vulnerability requiring low privileges (authenticated user) with low attack complexity and no user interaction. The impact is high availability loss but no confidentiality or integrity compromise. SSVC signals show exploitation status as 'poc' (proof-of-concept code exists), automatable as 'no' (parameter injection requires knowledge of FDC API structure), and technical impact as 'partial' (DoS is bounded to the FDC integration, not total system compromise). While the CVSS score of 6.5 is moderate, real-world risk is further constrained by the authentication requirement (PR:L) - only legitimate application users can trigger the vulnerability. The POC availability without KEV status (no confirmed active exploitation by CISA) suggests security researcher awareness but not yet widespread weaponization. For organizations using Tandoor Recipes with untrusted users, this remains a valid priority due to easy automation of DoS attacks once inside; for private or tightly-controlled deployments, risk is lower.

An authenticated user discovers they can inject URL parameters by appending '&key=attacker_key' to their FDC food search query. The attacker submits a search for 'apple&key=malicious', causing Tandoor Recipes to construct a malformed upstream API request to USDA FDC with their injected key override. The external API either rejects the request (triggering an HTTP 500 error returned to the user) or processes the attacker-controlled parameter, allowing reconnaissance of FDC API behavior or redirection of results. Repeated exploitation causes repeated server errors, degrading service availability for legitimate users. Proof-of-concept code demonstrating this injection technique is publicly available, lowering the barrier to exploitation by moderately-skilled attackers.