CVE-2026-111899

Medium

Description

KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that allows authenticated household members to bypass IP filtering via a second unfiltered fetch. Attackers can host a page titled KitchenOwl at a URL matching /recipe/<id>. The follow-up requests.get() call can then be redirected or DNS-rebound to loopback, private-network, or cloud-metadata addresses, exposing internal services.

SeverityMedium

CVSS4.3

Exploit probability—

ProductTombursch Kitchenowl

PublishedOct 19, 2026

First seenOct 19, 2026

Weakness typeCWE-918Server-side request forgery (SSRF)

How to fix

Patches

github.com/TomBursch/kitchenowl/commit/292f6f50a8e8bfa487292e9fd0ea0c54a860c28f

Affected products

Product	Affected versions	Fixed in
TomBursch kitchenowl	v ≤ 0.7.10	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.