What is the CVSS score of CVE-2026-43985?

CVE-2026-43985 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Tautulli are affected by CVE-2026-43985?

Tautulli, a Plex media server administration tool, contains a high-severity CSRF vulnerability (CVSS 8.8) that enables attackers to hijack administrator accounts when admins visit malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-43985?

Within 24 hours: Inventory all systems running Tautulli and document current versions. Within 7 days: Update all instances to Tautulli 2.17.1 or later. Within 30 days: Audit administrator account activity logs for unauthorized changes and conduct security review of recent configuration modifications.

Tautulli CVE-2026-43985

EUVD-2026-34285 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-04 GitHub_M

CSRF Python

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 04, 2026 - 17:16 EUVD

Source Code Evidence Fetched

Jun 04, 2026 - 16:16 vuln.today

Analysis Generated

Jun 04, 2026 - 16:16 vuln.today

DescriptionGitHub Advisory

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose configUpdate as a state-changing administrator endpoint, but the route does not enforce POST and does not use any anti-CSRF token. In the default form and JWT-based authentication mode, the administrator session cookie is issued with SameSite=Lax, which still permits top-level cross-site navigation requests. An attacker can exploit this by luring a logged-in administrator to a malicious page that submits a cross-site request to /configUpdate and overwrites the local administrator username and password. The attacker can then sign in directly with the chosen credentials and take over the Tautulli administrative interface. Version 2.17.1 patches the issue.

AnalysisAI

Cross-site request forgery in Tautulli versions prior to 2.17.1 allows remote attackers to hijack administrator accounts by tricking an authenticated admin into visiting a malicious page. The /configUpdate endpoint accepts state-changing requests without enforcing POST or validating anti-CSRF tokens, and because the session cookie uses SameSite=Lax it remains attached to top-level cross-site navigations. No public exploit identified at time of analysis, but the fix is explicitly called out in the v2.17.1 release notes.

Technical ContextAI

Tautulli is a Python-based monitoring and tracking application for Plex Media Server (CPE cpe:2.3:a:tautulli:tautulli). The root cause is CWE-352 (Cross-Site Request Forgery): the configUpdate administrative route was reachable via GET as well as POST and lacked an anti-CSRF token, while the form-based and JWT-based authentication modes issued session cookies with SameSite=Lax. SameSite=Lax blocks cookies on most cross-site subresource requests but still attaches them to top-level navigations (e.g., a form auto-submitted on page load or a window.location redirect), which is the exact primitive the attacker leverages to invoke a privileged state change on the victim's behalf.

RemediationAI

Vendor-released patch: upgrade to Tautulli 2.17.1 or later, which adds anti-CSRF tokens, enforces POST on state-changing endpoints, hashes the Tautulli cookie name (invalidating all existing sessions), and requires the X-Api-Key header for /auth/signin per the v2.17.1 release notes (https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1) and advisory GHSA-v622-pmjj-gpx3. If patching cannot be done immediately, restrict the Tautulli web UI to a trusted network segment or VPN to prevent admins from being navigated to attacker pages while their session is live, and require admins to log out of Tautulli before browsing untrusted content; both controls reduce exposure but do not eliminate the underlying CSRF defect. Avoid keeping Tautulli sessions persistent in the same browser profile used for general web browsing as an interim measure.