CVE-2026-59966 TandoorRecipes CVE debrief

Who should care

Defenders responsible for Tandoor Recipes instances, particularly those with user-controlled automation regex patterns, should assess exposure and prioritize verification and remediation.

Why it matters

Defenders should care about CVE-2026-59966 because it allows an authenticated user to store a malicious regex pattern that can cause a denial of service when triggered by another user, potentially impacting service availability and requiring verification and remediation efforts.

• Potential denial of service due to exhaustion of application worker slots
• Need for verification of Tandoor Recipes instances and user-controlled automation regex patterns
• Possible impact on service availability for users

Technical summary

Tandoor Recipes executes user-controlled Automation regular-expression patterns with Python re.sub() without complexity validation or an execution timeout. An authenticated user can store a catastrophic-backtracking regex, which can be triggered when another user in the same Space imports a matching recipe, potentially exhausting application worker slots. The attack works because the shared-Space automation engine evaluates the malicious pattern during recipe import and can occupy a Gunicorn worker until its request timeout. This can exhaust application worker slots and make the service unavailable to users.

Defensive priority

Defenders should prioritize verifying and updating Tandoor Recipes instances to version 2.6.10 or later, and review user-controlled automation regex patterns for potential vulnerabilities.

Recommended defensive actions

• Verify Tandoor Recipes instances are updated to version 2.6.10 or later
• Review user-controlled automation regex patterns for potential vulnerabilities
• Monitor application worker slots and service availability
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and fixed version. However, there is limited information on potential exploitation or victim impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.