CVE-2026-111899

18th percentile - higher than 18% of all known CVEs

KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that allows authenticated household members to bypass IP filtering via a second unfiltered fetch. Attackers can host a page titled KitchenOwl at a URL matching /recipe/<id>. The follow-up requests.get() call can then be redirected or DNS-rebound to loopback, private-network, or cloud-metadata addresses, exposing internal services.

An authenticated attacker could access internal services and cloud metadata, potentially leading to data leakage or privilege escalation. The risk affects organizations using KitchenOwl with access to internal networks.

Update KitchenOwl to a version later than 0.7.10 if available, or restrict the ability to import recipes from external sources. Monitor outbound traffic from the application for attempts to access internal addresses.