CVE-2026-41065

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 are vulnerable to remote code execution via the newsletter custom template directory feature. On a fresh install before the setup wizard is completed, all management endpoints are completely unauthenticated. An attacker can create a newsletter agent, point the custom template directory to an attacker-controlled SMB share serving a malicious Mako template, and trigger execution via the newsletter render endpoint, all with zero credentials and no local access to the target system. On a completed install with credentials configured, the same chain is exploitable by any admin. Version 2.17.1 fixes the issue.

CVSS

No CVSS.

References

Link	Resource
https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1
https://github.com/Tautulli/Tautulli/security/advisories/GHSA-68qx-mcf5-3jcp
https://github.com/Tautulli/Tautulli/security/advisories/GHSA-68qx-mcf5-3jcp

Configurations

No configuration.

History

No history.

Information

Published : 2026-06-04 15:16

Updated : 2026-07-22 20:10

NVD link : CVE-2026-41065

Mitre link : CVE-2026-41065

CVE.ORG link : CVE-2026-41065

JSON object : View

Products Affected

No product.

CWE

CWE-1336

Improper Neutralization of Special Elements Used in a Template Engine

{"id": "CVE-2026-41065", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41065", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-04T14:28:47.924769Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Tautulli", "product": "Tautulli", "versions": [{"status": "affected", "version": "< 2.17.1"}]}]}], "published": "2026-06-04T15:16:53.873", "references": [{"url": "https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/Tautulli/Tautulli/security/advisories/GHSA-68qx-mcf5-3jcp", "source": "security-advisories@github.com"}, {"url": "https://github.com/Tautulli/Tautulli/security/advisories/GHSA-68qx-mcf5-3jcp", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1336"}]}], "descriptions": [{"lang": "en", "value": "Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 are vulnerable to remote code execution via the newsletter custom template directory feature. On a fresh install before the setup wizard is completed, all management endpoints are completely unauthenticated. An attacker can create a newsletter agent, point the custom template directory to an attacker-controlled SMB share serving a malicious Mako template, and trigger execution via the newsletter render endpoint, all with zero credentials and no local access to the target system. On a completed install with credentials configured, the same chain is exploitable by any admin. Version 2.17.1 fixes the issue."}, {"lang": "es", "value": "Tautulli es una herramienta de monitoreo y seguimiento basada en Python para Plex Media Server. Las versiones anteriores a la 2.17.1 son vulnerables a la ejecuci\u00f3n remota de c\u00f3digo a trav\u00e9s de la funci\u00f3n de directorio de plantilla personalizada del bolet\u00edn. En una instalaci\u00f3n nueva, antes de que se complete el asistente de configuraci\u00f3n, todos los puntos finales de gesti\u00f3n no est\u00e1n completamente autenticados. Un atacante puede crear un agente de boletines, apuntar el directorio de plantilla personalizada a un recurso compartido SMB controlado por el atacante que sirve una plantilla Mako maliciosa, y desencadenar la ejecuci\u00f3n a trav\u00e9s del punto final de renderizado del bolet\u00edn, todo con cero credenciales y sin acceso local al sistema objetivo. En una instalaci\u00f3n completada con credenciales configuradas, la misma cadena es explotable por cualquier administrador. La versi\u00f3n 2.17.1 corrige el problema."}], "lastModified": "2026-07-22T20:10:00.127", "sourceIdentifier": "security-advisories@github.com"}