CVE-2026-35045 Tandoor CVE debrief

Who should care

Defenders responsible for Tandoor Recipes deployments, particularly those with private recipes or shared access, should assess exposure and apply the fix. This includes verifying exposure of private recipes and unauthorized access grants, assessing the impact of metadata tampering, and reviewing and updating access controls for recipe modification.

Why it matters

CVE-2026-35045 allows unauthorized modification of recipes in Tandoor Recipes, including private ones, bypassing object-level authorization checks. Defenders should verify exposure, assess impact, and apply the fix in version 2.6.4.

• Potential exposure of private recipes
• Unauthorized self-grant of access via shared lists
• Metadata tampering for recipes

Technical summary

The PUT /api/recipe/batch_update/ endpoint in Tandoor Recipes allows any authenticated user within a Space to modify any recipe in that Space, including recipes marked as private by other users. This bypasses object-level authorization checks enforced on standard single-recipe endpoints, enabling forced exposure of private recipes, unauthorized self-grant of access via the shared list, and metadata tampering. The vulnerability is fixed in version 2.6.4, and defenders should prioritize verifying exposure of private recipes and unauthorized access grants, assessing the impact of metadata tampering, and applying the fix.

Defensive priority

Defenders should prioritize verifying exposure of private recipes and unauthorized access grants, assessing the impact of metadata tampering, and applying the fix in version 2.6.4.

Recommended defensive actions

• Verify exposure of private recipes and unauthorized access grants
• Assess the impact of metadata tampering
• Apply the fix in version 2.6.4
• Review and update access controls for recipe modification
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fix in version 2.6.4. However, additional information on exploitation, victims, or business impact is not available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.