What happened
NVD REST verified (published 2026-10-16, CVSS 7.7, CWE-918, scope-changed). The AI provider URL is passed straight to LiteLLM with no SSRF filtering, yielding a blind network-reachability oracle.
Why it matters
An AI-feature endpoint built on LiteLLM is the SSRF vector: the same class of AI-gateway SSRF (probe internal hosts, reach cloud instance metadata) that has repeatedly compromised self-hosted AI products. In a Tandoor deployment the blind oracle can map the Docker/K8s host network and hit metadata ends, escalating to credential disclosure in cloud-hosted installs.
Attack vector
The AI actions in cookbook/views/api.py call completion through a user-supplied provider URL (TARGET/api/ai-import/, api/ai-step-sort/) without applying the server's outbound-request SSRF checks (safe_request) that LiteLLM paths normally get. An authenticated user creates a Space, configures an AI provider URL pointing at an internal address, and invokes an AI action to probe internal targets and cloud metadata endpoints.
Affected systems
TandoorRecipes/recipes < 2.6.10
Mitigation
Upgrade to Tandoor Recipes 2.6.10 (commit 79e7835; GHSA-wq4h-2r8x-cv65), which routes AI provider connections through the server's SSRF checks.