EUVD-2026-34273CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionNVD
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 are vulnerable to remote code execution via the newsletter custom template directory feature. On a fresh install before the setup wizard is completed, all management endpoints are completely unauthenticated. An attacker can create a newsletter agent, point the custom template directory to an attacker-controlled SMB share serving a malicious Mako template, and trigger execution via the newsletter render endpoint, all with zero credentials and no local access to the target system. On a completed install with credentials configured, the same chain is exploitable by any admin. Version 2.17.1 fixes the issue.
AnalysisAI
Remote code execution in Tautulli versions prior to 2.17.1 allows attackers to achieve unauthenticated RCE on fresh installations (pre-setup wizard) by abusing the newsletter custom template directory feature to load a malicious Mako template from an attacker-controlled SMB share. On completed installations the same chain remains exploitable by any authenticated admin. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | On a fresh install where the setup wizard has not been completed, no special conditions apply - all management endpoints are completely unauthenticated and exploitable remotely against default Tautulli deployments. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a high-priority vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker scans the internet for exposed Tautulli instances on default ports and identifies a fresh, unprovisioned install where the setup wizard has not yet been completed. They issue unauthenticated API calls to create a newsletter agent whose custom template directory points at an attacker-controlled SMB share (\\evil.example\share) hosting a malicious Mako template, then invoke the newsletter render endpoint, causing Tautulli to fetch and execute the template's Python payload as the Tautulli service account. … |
| Remediation | Vendor-released patch: upgrade to Tautulli 2.17.1 or later, available at https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1 with full advisory context at https://github.com/Tautulli/Tautulli/security/advisories/GHSA-68qx-mcf5-3jcp. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct an inventory of all Tautulli deployments and their configuration status; immediately isolate or restrict network access to any pre-setup instances. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Unauthenticated server-side request forgery in Tautulli versions prior to 2.17.1 allows remote attackers to coerce the T
Remote code execution in Hugging Face Transformers 5.2.0 allows a malicious model repository to bypass the user's explic
Path traversal in NASA AMMOS AIT-Core's Binary Stream Capture (BSC) component allows unauthenticated remote attackers to
Stored cross-site scripting in Tautulli before 2.17.1 allows low-privilege authenticated users (including guests when gu
Remote code execution in AWS AgentCore CLI before v0.14.2 allows authenticated attackers to inject Python code via craft
Share
External POC / Exploit Code
Leaving vuln.today