CVE-2026-33149 - Vulnerability Analysis

Overview

Tandoor Recipes <= 2.5.3 contains a host header injection caused by setting ALLOWED_HOSTS='*' allowing attackers to manipulate server-generated absolute URLs, letting attackers poison invite links, exploit requires sending crafted Host headers.

Severity & Score

Impact

Attackers can poison invite links to steal invite tokens, enabling unauthorized access to the application.

Mitigation

Update to the latest version with proper ALLOWED_HOSTS validation.

References

• https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-x636-4jx6-xc4w

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 26, 2026

🟠 CVE-2026-33149 - High (8.1) Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Versions up to and including 2.5.3 set ALLOWED_HOSTS = '*' by default, which causes Django to accept any value in the HTTP Host header without val... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33149/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner