What is the CVSS score of CVE-2026-31799?

CVE-2026-31799 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-31799?

Yes, a patch is available for CVE-2026-31799. Update the affected software to the latest version immediately.

Python CVE-2026-31799

EUVD-2026-17206 MEDIUM

Improper Input Validation (CWE-20)

2026-03-30 security-advisories@github.com

Python Code Injection

4.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2.17.0

EUVD ID Assigned

Mar 30, 2026 - 20:22 euvd

EUVD-2026-17206

Analysis Generated

Mar 30, 2026 - 20:22 vuln.today

CVE Published

Mar 30, 2026 - 20:16 nvd

MEDIUM 4.9

DescriptionGitHub Advisory

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 2.14.2 to before version 2.17.0 for parameters "before" and "after" and from version 2.1.0-beta to before version 2.17.0 for parameters "section_id" and "user_id", the /api/v2?cmd=get_home_stats endpoint passes the section_id, user_id, before, and after query parameters directly into SQL via Python %-string formatting without parameterization. An attacker who holds the Tautulli admin API key can inject arbitrary SQL and exfiltrate any value from the Tautulli SQLite database via boolean-blind inference. This issue has been patched in version 2.17.0.

AnalysisAI

SQL injection in Tautulli's /api/v2?cmd=get_home_stats endpoint allows authenticated administrators to exfiltrate sensitive data from the SQLite database via boolean-blind SQL inference. Affected versions include 2.14.2-2.16.x for the 'before' and 'after' parameters, and 2.1.0-beta-2.16.x for 'section_id' and 'user_id' parameters. The vulnerability requires possession of the admin API key and results in confidentiality compromise without code execution. Patch is available in version 2.17.0.

Technical ContextAI

Tautulli is a Python-based Plex Media Server monitoring application that exposes a REST API endpoint for retrieving home statistics. The vulnerable code passes user-supplied query parameters (section_id, user_id, before, after) directly into SQL queries using Python %-string formatting without parameterized query preparation. This is a classic code injection vulnerability (CWE-20: Improper Input Validation) where unsanitized user input is concatenated into SQL statements, allowing attackers to craft malicious SQL syntax. The SQLite backend and boolean-blind exfiltration technique enable data extraction through time-based or logical inference, even when query results are not directly returned to the attacker.

RemediationAI

Upgrade Tautulli to version 2.17.0 or later, which implements parameterized SQL queries for all affected parameters. Users unable to upgrade immediately should restrict network access to the Tautulli admin API (e.g., firewall rules, VPN-only access) and rotate any exposed admin API keys. Verify that API keys are not leaked in configuration files, logs, or version control. Monitor access logs for suspicious /api/v2?cmd=get_home_stats requests containing SQL metacharacters or unusual parameter patterns. See https://github.com/Tautulli/Tautulli/releases/tag/v2.17.0 for upgrade instructions.