Tautulli CVE-2026-41065

On a fresh install where the setup wizard has not been completed, no special conditions apply - all management endpoints are completely unauthenticated and exploitable remotely against default Tautulli deployments. The specific feature required is the newsletter custom template directory configuration, which must accept the attacker's path; the attacker must also be able to host a malicious Mako template reachable by the Tautulli host (the described chain uses an SMB share, so the Tautulli host needs outbound SMB/TCP 445 connectivity to the attacker, or an internal share the attacker controls). On a fully provisioned install, exploitation is limited to authenticated admin users, because login is enforced once setup is complete; this is the primary real-world limiter for hardened, post-setup deployments.

This is a high-priority vulnerability. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) yields a base score of 8.9 with no attack complexity, no privileges, and no user interaction required against a fresh install. SSVC reinforces this with Exploitation=PoC, Automatable=Yes, and Technical Impact=Total, indicating the exploit chain is reproducible and scriptable end-to-end. Publicly available exploit code exists (per SSVC PoC status); however, no CISA KEV listing was provided and no EPSS score was supplied in the input, so widespread in-the-wild exploitation cannot be confirmed. The realistic risk is highest for internet-exposed Tautulli instances that have not completed the setup wizard, and for any multi-admin deployment where lateral abuse by a low-trust admin matters. The dependency on outbound SMB (port 445) to attacker infrastructure is the main practical limiter in hardened environments, but networks that permit egress SMB or that an attacker can host internally are fully exposed.

An attacker scans the internet for exposed Tautulli instances on default ports and identifies a fresh, unprovisioned install where the setup wizard has not yet been completed. They issue unauthenticated API calls to create a newsletter agent whose custom template directory points at an attacker-controlled SMB share (\\evil.example\share) hosting a malicious Mako template, then invoke the newsletter render endpoint, causing Tautulli to fetch and execute the template's Python payload as the Tautulli service account. Publicly available exploit code exists per SSVC, making this readily automatable across many targets in a single sweep.