Server-Side Request Forgery Vulnerability in KitchenOwl by Tom Bursch

CVE-2026-111899

What is CVE-2026-111899?

KitchenOwl version 0.7.10 is affected by a server-side request forgery vulnerability that arises from the recipe import functionality. This issue allows authenticated household members to bypass IP filtering mechanisms by executing a second unfiltered fetch request. Attackers can exploit this weakness by hosting a malicious page titled 'KitchenOwl' at specific URLs, leading to the potential exposure of internal services. The vulnerability facilitates unauthorized access to loopback, private-network, or cloud metadata addresses, presenting significant security risks to affected installations.

References