Tautulli CVE-2026-43985

Exploitation requires (1) a Tautulli instance running a version prior to 2.17.1 in the default form-based or JWT-based authentication mode where the admin session cookie is SameSite=Lax, (2) an administrator who is actively signed in to that Tautulli instance, (3) that administrator being lured to attacker-controlled web content in the same browser as the active session (UI:R in the CVSS vector), and (4) network reachability from the victim's browser to the Tautulli /configUpdate endpoint - for purely LAN-only deployments the victim's browser must be on the same network. The attack does not require the attacker to authenticate to Tautulli or chain any other vulnerability, but it cannot succeed against logged-out admins or against deployments where the admin UI is unreachable from the victim's browsing context.

The CVSS 3.1 base score is 8.8 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - network-reachable, low complexity, no privileges, but requires user interaction (the admin must browse to attacker-controlled content while authenticated). No EPSS score, KEV listing, or public POC was provided in the input, so real-world risk is meaningfully lower than the headline score suggests: exploitation depends on social engineering a logged-in admin, and Tautulli is typically deployed on home/internal networks rather than internet-exposed administrative panels. That said, full admin takeover with credential overwrite is a high-impact outcome and the vendor confirmed the issue, so the priority for any internet-exposed or shared-tenant instance is high. PR:N in the vector reflects that the attacker themselves is unauthenticated, not that the target endpoint is unauthenticated - the victim must be a logged-in admin for the attack to land.

An attacker hosts a page containing an auto-submitting HTML form (or a navigation that hits /configUpdate with crafted parameters) and lures a logged-in Tautulli administrator to visit it via phishing, a forum link, or a watering-hole site. Because the admin's SameSite=Lax session cookie is sent on the top-level navigation, the configUpdate handler accepts the request and overwrites the admin username and password with values the attacker chose. The attacker then logs into Tautulli directly with those credentials and fully controls the monitoring instance, including access to Plex metadata and notification integrations.