A blind SSRF vulnerability exists in TandoorRecipes:recipes prior to version 2.6.10. The application forwards an administrator-controlled AI provider URL directly to LiteLLM without applying the servers outbound-request SSRF safeguards when an authenticated user creates a Space, configures an AI provider with a URL targeting an internal address, and triggers an AI action. The server attempts to connect to the supplied URL for each AI action and leaks the result via connection success, refusal, or timeout, providing a blind network-reachability oracle. This allows an attacker to enumerate internal hosts and ports, including cloud metadata endpoints.

Affected installations are those running TandoorRecipes:recipes older than 2.6.10 that permit administrators to configure AI providers and authenticated users to create Spaces and invoke AI actions. Versions 2.6.10 and newer include the fix that restores proper SSRF checks.

The vulnerability carries a CVSS score of 7.7. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is a legitimate authenticated user with permission to create Spaces and configure AI providers. By repeatedly invoking AI actions, the attacker receives success or failure responses that reveal network reachability, enabling further lateral movement. No privilege escalation is required, but the flaw can serve as a stepping stone to internal resources.