Tautulli CVE-2026-31804

This vulnerability presents a moderate but real risk despite the CVSS 4.0 score. The CVSS vector confirms unauthenticated remote network access (AV:N, PR:N, UI:N) with high attack complexity (AC:H), resulting in low confidentiality impact and cross-boundary scope change. The SSRF class (CWE-918) is a known attack primitive commonly chained with other vulnerabilities. While the CVSS score reflects the limited direct impact (low confidentiality only), the real-world risk is elevated by several factors: (1) Tautulli is explicitly excluded from authentication, making exploitation trivial; (2) the vulnerability enables reconnaissance of internal infrastructure with the privileges of the Plex Media Server process; (3) Plex often has network access to RFC-1918 ranges and may interact with other internal services; (4) this can serve as a pivot point in targeted attacks. The AC:H constraint suggests some exploitation complexity exists (possibly requiring specific Plex configurations or request formatting), but this does not eliminate risk. Organizations running Tautulli in environments with sensitive internal services should prioritize patching.

An attacker without authentication crafts an HTTP request to Tautulli's /pms_image_proxy endpoint with img=http://internal.service.local:8080/admin, causing Tautulli to forward this request to Plex, which then issues the request from the internal network context. The attacker observes response times, HTTP status codes, or error messages to map internal services and identify attack targets. If combined with knowledge of internal service vulnerabilities, subsequent requests could exploit those services using the Plex process's network access and privileges. No public exploit code is referenced in the advisory, but exploitation requires only standard HTTP requests, making the attack highly practical despite AC:H.