What is the CVSS score of CVE-2026-31804?

CVE-2026-31804 has a CVSS 3.1 base score of 4.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-31804?

Yes, a patch is available for CVE-2026-31804. Update the affected software to the latest version immediately.

Python CVE-2026-31804

EUVD-2026-17190 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-30 GitHub_M

Python SSRF

4.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.0 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2.17.0

EUVD ID Assigned

Mar 30, 2026 - 19:45 euvd

EUVD-2026-17190

Analysis Generated

Mar 30, 2026 - 19:45 vuln.today

CVE Published

Mar 30, 2026 - 19:42 nvd

MEDIUM 4.0

DescriptionGitHub Advisory

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /pms_image_proxy endpoint accepts a user-supplied img parameter and forwards it to Plex Media Server's /photo/:/ transcode transcoder without authentication and without restricting the scheme or host. The endpoint is intentionally excluded from all authentication checks in webstart.py, any value of img beginning with http is passed directly to Plex, this causes the Plex Media Server process, which typically runs on the same host or internal network as Tautulli, with access to RFC-1918 address space, to issue an outbound HTTP request to any attacker-specified URL. This issue has been patched in version 2.17.0.

AnalysisAI

Server-Side Request Forgery (SSRF) in Tautulli prior to version 2.17.0 allows remote attackers to forge outbound HTTP requests from the Plex Media Server process via the unauthenticated /pms_image_proxy endpoint, potentially exposing internal services on RFC-1918 address space and enabling reconnaissance or attacks against systems accessible from the Plex server's network context.

Technical ContextAI

Tautulli is a Python-based monitoring application for Plex Media Server that includes a /pms_image_proxy endpoint explicitly excluded from authentication checks. The vulnerability stems from CWE-918 (SSRF), where the endpoint accepts an img parameter and forwards it directly to Plex's /photo/:/ transcode endpoint without validating the scheme, host, or applying any request filtering. Since Plex Media Server typically operates with access to internal RFC-1918 address space and may run on the same host or internal network as Tautulli, an attacker can manipulate this endpoint to force the Plex process to issue HTTP requests to arbitrary URLs. The vulnerable code path treats any img parameter beginning with 'http' as a valid proxy target and passes it directly to Plex without restriction, enabling attackers to enumerate internal services, access local file systems via file:// schemes (if Plex supports them), or interact with services on the internal network.

RemediationAI

Vendor-released patch: Tautulli 2.17.0. Upgrade immediately to version 2.17.0 or later from the official GitHub releases (https://github.com/Tautulli/Tautulli/releases/tag/v2.17.0). No workarounds are documented in the advisory; patching is the primary remediation. Review and verify the patch includes authentication enforcement on the /pms_image_proxy endpoint and proper validation of img parameter schemes and hosts before forwarding to Plex. For environments unable to immediately patch, implement network-level controls to restrict outbound HTTP requests from the Plex Media Server process or disable/block the /pms_image_proxy endpoint if not required for operation.