EUVD-2026-34286Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Lifecycle Timeline
3DescriptionCVE.org
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose a public /image/<hash> route that resolves attacker-controlled entries from image_hash_lookup and replays them through the same server-side image fetch logic used by authenticated image proxying. A low-privilege guest user can seed a malicious external image URL into this lookup table and then trigger server-side fetches through a fully unauthenticated endpoint. This turns an authenticated SSRF primitive into a persistent unauthenticated SSRF gadget. Once the malicious hash entry exists, any external user can request /image/<hash>.png and cause the PMS or Tautulli host to fetch an arbitrary attacker-chosen URL. Version 2.17.1 patches the issue.
AnalysisAI
Unauthenticated server-side request forgery in Tautulli versions prior to 2.17.1 allows remote attackers to coerce the Tautulli or Plex Media Server host into fetching arbitrary attacker-chosen URLs via the public /image/<hash> route. A low-privilege guest first seeds a malicious external URL into the image_hash_lookup table, after which any unauthenticated external user can trigger the SSRF by requesting the resulting hash. No public exploit identified at time of analysis, but the GitHub Security Advisory GHSA-m6j6-rc2c-8vpm and a vendor patch in v2.17.1 confirm the issue.
Technical ContextAI
Tautulli is a Python-based monitoring and tracking application for Plex Media Server (CPE cpe:2.3:a:tautulli:tautulli). The root cause is CWE-918 (Server-Side Request Forgery): the /image/<hash> endpoint resolves hash entries from an internal image_hash_lookup table and reuses the same server-side image-fetch routine used by the authenticated image-proxy path, without re-verifying that the cached entry originated from a trusted source. Because guests can write entries into this lookup table and the resolution endpoint is publicly reachable, the originally authenticated proxy gadget becomes a persistent unauthenticated fetch primitive. The v2.17.1 fix (Do not store image hash for external images) addresses the root cause by refusing to cache externally-sourced URLs into the lookup table.
RemediationAI
Vendor-released patch: upgrade to Tautulli 2.17.1 or later, which stops storing image hashes for external images and closes the SSRF gadget (release notes at https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1, advisory at https://github.com/Tautulli/Tautulli/security/advisories/GHSA-m6j6-rc2c-8vpm). If immediate patching is not possible, disable guest account creation and revoke existing guest tokens to remove the seeding primitive (side effect: legitimate guest users lose access), restrict inbound access to the /image/ route to trusted clients via a reverse proxy or WAF rule (side effect: may break image proxying for legitimate remote viewers), and place the Tautulli host on an egress-restricted network segment so SSRF fetches cannot reach internal Plex hosts, cloud metadata endpoints (e.g., 169.254.169.254), or other internal services (side effect: any outbound integrations such as poster fetching must be allow-listed). The 2.17.1 release also bundles fixes for CVE-2026-41065, CVE-2026-40605, CVE-2026-43984, and CVE-2026-43985, so upgrading addresses several issues at once.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today