Description
KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that allows authenticated household members to bypass IP filtering via a second unfiltered fetch. Attackers can host a page titled KitchenOwl at a URL matching /recipe/<id>. The follow-up requests.get() call can then be redirected or DNS-rebound to loopback, private-network, or cloud-metadata addresses, exposing internal services.
Published: 2026-10-19
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Server‑Side Request Forgery allowing access to internal network resources
Action: Mitigate
AI Analysis

Impact

The vulnerability is a Server‑Side Request Forgery that permits authenticated KitchenOwl users to craft a recipe import request that causes the server to perform an unfiltered HTTP request. This bypasses the normal IP filtering and can reach loopback, private‑network, or cloud‑metadata addresses, exposing internal services and data. The flaw is an instance of CWE‑918: Server‑Side Request Forgery.

Affected Systems

TomBursch’s KitchenOwl application, versions 0.7.10 and earlier.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. No EPSS data is available, and the issue is not listed in the CISA KEV catalog. Exploitation requires the attacker to be an authenticated household member and to trigger a recipe‑import operation, after which a second request can be hijacked to reach private endpoints.

Generated by OpenCVE AI on October 19, 2026 at 15:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Block outbound requests from KitchenOwl to local, loopback, or private IP ranges to prevent internal access
  • Disable or restrict the recipe‑import feature until a verified fix is released
  • Apply network segmentation or firewall rules to isolate KitchenOwl from internal services
  • Check for an official KitchenOwl release that addresses the SSRF flaw

Generated by OpenCVE AI on October 19, 2026 at 15:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
Description KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that allows authenticated household members to bypass IP filtering via a second unfiltered fetch. Attackers can host a page titled KitchenOwl at a URL matching /recipe/<id>. The follow-up requests.get() call can then be redirected or DNS-rebound to loopback, private-network, or cloud-metadata addresses, exposing internal services.
Title KitchenOwl through 0.7.10 SSRF via Recipe Import scrapeKitchenOwl Fetch
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-19T18:12:44.619Z

Reserved: 2026-10-17T12:16:44.850Z

Link: CVE-2026-111899

cve-icon Vulnrichment

Updated: 2026-10-19T18:12:39.701Z

cve-icon NVD

Status : Received

Published: 2026-10-19T14:17:00.590

Modified: 2026-10-19T19:17:24.160

Link: CVE-2026-111899

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T16:00:15Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)