Back to the CVE list

CVE-2026-59970

Tandoor Recipes: Blind SSRF via AI provider URL (api_base)

CVSS score

7.7

EPSS probability

%0.3

Risk score

0.0

Published

3 d ago

Overview Public Exploits (1)Newsroom Vulnerability Timeline

Public Exploits · GitHub and Metasploit Intelligence

This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.

G

asvorg/CVE-2026-59970-poc

GitHub

PoC for CVE-2026-59970 Blind SSRF in Tandoor Recipes, CWE-918 (★0)

Public PoCSource updated: 17.10.2026 11:38:38

Similar Vulnerabilities

8.1

CVE-2026-61726Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content

VendorTandoorRecipes Productrecipes

Patch status unknownEPSS %03 d ago

5.7

CVE-2026-59966Tandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex Patterns

VendorTandoorRecipes Productrecipes

Patch status unknownEPSS %03 d ago

6.5

CVE-2026-59962Tandoor Recipes: ORM ORDER BY Injection via FK Traversal in Tandoor Recipes

VendorTandoorRecipes Productrecipes

Patch status unknownEPSS %03 d ago

7.1

CVE-2026-59963Tandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpoints

VendorTandoorRecipes Productrecipes

Patch status unknownEPSS %03 d ago

5.4

CVE-2026-59967Tandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet import — read and destroy another space member's pending BookmarkletImport

VendorTandoorRecipes Productrecipes

Patch status unknownEPSS %03 d ago

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free key Documentation

curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-59970"