Is CVE-2026-35489 actively exploited?

No active exploitation of CVE-2026-35489 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-35489 be exploited remotely?

Yes. CVE-2026-35489 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-35489?

CVE-2026-35489 has a CVSS score of 7.3 (HIGH).

HOME VULNERABILITIESCVE-2026-35489

HIGH

CVE-2026-35489

CWE-639Published: April 7, 2026· Updated: Apr 8, 2026

7.3

CVSS v3.1

EPSS:0.05%probability of exploitation in 30 daysPercentile:16.8th

Official Description

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the POST /api/food/{id}/shopping/ endpoint reads amount and unit directly from request.data and passes them without validation to ShoppingListEntry.objects.create(). Invalid amount values (non-numeric strings) cause an unhandled exception and HTTP 500. A unit ID from a different Space can be associated cross-space, leaking foreign-key references across tenant boundaries. All other endpoints creating ShoppingListEntry use ShoppingListEntrySerializer, which validates and sanitizes these fields. This vulnerability is fixed in 2.6.4.

NVD Source

Technical Analysis

CVE-2026-35489 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.