What is the CVSS score of CVE-2026-43984?

CVE-2026-43984 has a CVSS 3.1 base score of 8.9 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Tautulli are affected by CVE-2026-43984?

Tautulli before version 2.17.1 contains a stored cross-site scripting vulnerability that allows low-privilege users (including guest accounts) to inject malicious code into application logs, which…. A patch is available.

How to fix or mitigate CVE-2026-43984?

Within 24 hours: Inventory all Tautulli instances, identify current versions, and disable guest access if operationally feasible. Within 7 days: Upgrade all instances running versions before 2.17.1 to Tautulli 2.17.1 or later. Within 30 days: Review administrative activity logs for anomalies and reset all administrator credentials.

Tautulli CVE-2026-43984

EUVD-2026-34284 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-04 GitHub_M

XSS Python Tautulli

8.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.9 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Jun 04, 2026 - 17:16 EUVD

Source Code Evidence Fetched

Jun 04, 2026 - 16:15 vuln.today

Analysis Generated

Jun 04, 2026 - 16:15 vuln.today

DescriptionCVE.org

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose log_js_errors to any authenticated user, including guest users when guest access is enabled. The endpoint writes attacker-controlled strings directly into the main application log. The administrator-only logFile view then reads that log file and embeds it into an HTML response without escaping. This creates a stored cross-site scripting condition where a low-privilege guest can inject HTML or JavaScript into the log file and have it execute in an administrator's browser when the log viewer is opened. Version 2.17.1 patches the issue.

AnalysisAI

Stored cross-site scripting in Tautulli before 2.17.1 allows low-privilege authenticated users (including guests when guest access is enabled) to inject HTML/JavaScript into the main application log via the log_js_errors endpoint, which later executes in an administrator's browser when the admin opens the logFile viewer. The flaw enables privilege escalation against the Plex Media Server monitoring tool's admin account. No public exploit identified at time of analysis, but the vendor-published advisory and confirmed patch in 2.17.1 make the issue well-documented.

Technical ContextAI

Tautulli is a Python-based monitoring and tracking application for Plex Media Server (CPE cpe:2.3:a:tautulli:tautulli). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation) realized as a stored XSS chain: the log_js_errors endpoint accepts attacker-controlled strings from any authenticated user and writes them verbatim into the main application log, while the administrator-only logFile view reads that log and embeds the content into an HTML response without HTML-escaping. Because the sink is the application log itself, any low-privilege user who can reach the endpoint can persistently taint admin-rendered output - a classic log-poisoning-into-XSS pattern.

RemediationAI

Vendor-released patch: upgrade Tautulli to version 2.17.1 or later, which sanitizes JS log errors before they are written to the main application log (see https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1 and advisory https://github.com/Tautulli/Tautulli/security/advisories/GHSA-f4j7-pjwc-4jrr). If immediate patching is not possible, disable guest access in Tautulli settings to remove the lowest-privilege attack surface (trade-off: guest users lose read-only visibility), restrict the Tautulli web UI to a trusted network or VPN to eliminate untrusted authenticated reach, and instruct administrators to avoid opening the log viewer until the upgrade is applied since admin browser interaction is required to fire the stored payload.