CVE-2026-59966

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controlled Automation regular-expression patterns with Python re.sub() without complexity validation or an execution timeout when an authenticated user stores a catastrophic-backtracking regex and any user in the same Space imports a matching recipe. Request processing uses Automation.param_2, apply_regex_replace_automation, sub, api/recipe-from-source/. The attack works because the shared-Space automation engine evaluates the malicious pattern during recipe import and can occupy a Gunicorn worker until its request timeout. This can exhaust application worker slots and make the service unavailable to users. This issue is fixed in version 2.6.10.

• CWE-1333

• https://github.com/TandoorRecipes/recipes/commit/adc2732712819d7fe26a9f74f6b0271c1a9d87c3
• https://github.com/TandoorRecipes/recipes/releases/tag/2.6.10
• https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-f2gw-c2c7-59v7
• https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-f2gw-c2c7-59v7

Published

Oct 16, 2026

Last Modified

Oct 19, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-59959SAIL is a cross-platform library for loading and saving imag…4.8
• CVE-2026-5996A security vulnerability has been detected in Totolink A7100…9.8
• CVE-2026-59960Argos JavaScript provides official Argos SDKs for JavaScript…7.5
• CVE-2026-59962Tandoor Recipes is an application for managing recipes, plan…6.5
• CVE-2026-59963Tandoor Recipes is an application for managing recipes, plan…7.1
• CVE-2026-59965Payload Plugins is a collection of plugins designed to enhan…7.1
• CVE-2026-59967Tandoor Recipes is an application for managing recipes, plan…5.4
• CVE-2026-59969Apache ZooKeeper quorum TLS fails to enforce peer hostname v…7.5
• CVE-2026-5997A vulnerability was detected in Totolink A7100RU 7.4cu.2313_…9.8
• CVE-2026-59970Tandoor Recipes is an application for managing recipes, plan…7.7
• CVE-2026-59971MySQL MCP Server is a Model Context Protocol server that ena…10
• CVE-2026-59973FrontMCP is a TypeScript-first framework for the Model Conte…8.5