Which versions of Tautulli are affected by CVE-2026-41065?

Tautulli versions prior to 2.17.1 are vulnerable to unauthenticated remote code execution on pre-setup systems and authenticated RCE on configured installations (CVE-2026-41065, CVSS 8.9).. A patch is available.

How to fix or mitigate CVE-2026-41065?

Within 24 hours: Conduct an inventory of all Tautulli deployments and their configuration status; immediately isolate or restrict network access to any pre-setup instances. Within 7 days: Upgrade all Tautulli installations to version 2.17.1 or later. Within 30 days: Implement network segmentation to limit Tautulli access to administrative networks only, review audit logs for exploitation attempts, and deploy monitoring for SMB share access patterns from Tautulli systems.

Tautulli CVE-2026-41065

Q: What is the CVSS score of CVE-2026-41065?

CVE-2026-41065 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-34273 HIGH

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-06-04 GitHub_M

Python Ssti RCE Tautulli

8.9

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 04, 2026 - 16:50 vuln.today

Analysis Generated

Jun 04, 2026 - 16:50 vuln.today

Patch available

Jun 04, 2026 - 16:16 EUVD

CVSS changed

Jun 04, 2026 - 15:22 NVD

8.9 (HIGH)

CVE Published

Jun 04, 2026 - 14:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 are vulnerable to remote code execution via the newsletter custom template directory feature. On a fresh install before the setup wizard is completed, all management endpoints are completely unauthenticated. An attacker can create a newsletter agent, point the custom template directory to an attacker-controlled SMB share serving a malicious Mako template, and trigger execution via the newsletter render endpoint, all with zero credentials and no local access to the target system. On a completed install with credentials configured, the same chain is exploitable by any admin. Version 2.17.1 fixes the issue.

AnalysisAI

Remote code execution in Tautulli versions prior to 2.17.1 allows attackers to achieve unauthenticated RCE on fresh installations (pre-setup wizard) by abusing the newsletter custom template directory feature to load a malicious Mako template from an attacker-controlled SMB share. On completed installations the same chain remains exploitable by any authenticated admin. Publicly available exploit code exists per SSVC, and the SSVC framework rates this as automatable with total technical impact, though no CISA KEV listing has been confirmed.

Technical ContextAI

Tautulli is a Python-based monitoring and tracking application for Plex Media Server (CPE: cpe:2.3:a:tautulli:tautulli). The root cause maps to CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine), specifically a server-side template injection (SSTI) vector through the Mako template engine. Mako templates compile to Python bytecode and execute arbitrary Python at render time, so any user-controlled template path effectively grants code execution. The custom template directory feature was designed to accept a filesystem path, but did not restrict remote/UNC paths, allowing the rendering engine to fetch and execute a hostile Mako template from an attacker-hosted SMB share. Compounding the issue, fresh installations expose all management endpoints without authentication until the setup wizard is completed.

RemediationAI

Vendor-released patch: upgrade to Tautulli 2.17.1 or later, available at https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1 with full advisory context at https://github.com/Tautulli/Tautulli/security/advisories/GHSA-68qx-mcf5-3jcp. Note that v2.17.1 introduces a behavioral change: using mounted folders for custom newsletter templates and scripts now requires manually setting allow_mounted_folders = 1 in the config file, so administrators relying on network-mounted template directories must opt back in after upgrading. If immediate patching is not possible, complete the setup wizard on any fresh install so management endpoints require authentication, block outbound SMB (TCP/445) egress from the Tautulli host to prevent retrieval of attacker-hosted Mako templates, and restrict access to the newsletter configuration and render endpoints via reverse-proxy ACLs; these mitigations reduce exposure but do not eliminate admin-level abuse on completed installs. Existing login sessions will be invalidated after upgrade because the cookie name is now hashed, and the /auth/signin endpoint now requires an X-Api-Key header - both should be planned for in any automation.