Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, there is a Blind Server-Side Request Forgery (SSRF) vulnerability in the Cookmate recipe import feature of Tandoor Recipes. The application fails to validate the destination URL after following HTTP redirects, allowing any authenticated user (including standard users without administrative privileges) to force the server to connect to arbitrary internal or external resources. The vulnerability lies in cookbook/integration/cookmate.py, within the Cookmate integration class. This vulnerability can be leveraged to scan internal network ports, access cloud instance metadata (e.g., AWS/GCP Metadata Service), or disclose the server's real IP address. This vulnerability is fixed in 2.5.1.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-13 | 2 | Disclosure2 |
| 2026-02-15 | 1 | Disclosure1 |
| 2026-02-18 | 1 | General1 |
CVE-2026-25991 Blind Server-Side Request Forgery in Tandoor Recipes Cookmate Import Feature https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25991
Post summary
The text announces CVE-2026-25991, a blind SSRF vulnerability in Tandoor Recipes’ Cookmate Import feature, but provides only basic information and no proof of concept, exploit code, or mitigation details.
CVE-2026-25991 (CVSS:7.7, HIGH) is Analyzed. Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, the..https://nvd.nist.gov/vuln/detail/CVE-2026-25991 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post mentions CVE-2026-25991 with its CVSS score but offers no further details on exploitation, patches, or PoC.
Affected `Tandoor Recipes` instances are vulnerable to a blind SSRF (CVE-2026-25991) via recipe import, allowing internal network access. #AppSec #SSRF #infosec https://www.pulsepatch.io/posts/cve-2026-25991-tandoor-recipes-blind-ssrf
Post summary
Tandoor Recipes is vulnerable to a blind SSRF (CVE-2026-25991) through recipe import, enabling attackers to reach internal network resources.
CVE-2026-25991 Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, there is a Blind Server-Side Request Forgery (SSR… https://www.cve.org/CVERecord?id=CVE-2026-25991
Post summary
The text discloses a blind SSRF vulnerability (CVE‑2026‑25991) affecting Tandoor Recipes prior to version 2.5.1, without providing PoC, exploit details, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | tandoor | recipes | - | - | - |