Tautulli EUVD-2026-34286

Exploitation requires (1) initial access to a low-privilege guest account on the target Tautulli instance to seed an entry into the image_hash_lookup table via the existing authenticated image-proxy code path, and (2) network reachability to the public /image/<hash> endpoint for the unauthenticated trigger step - which is the default deployment posture for Tautulli when exposed for remote access. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: Tautulli deployments that do not provision guest accounts or that gate the web UI behind a VPN/SSO reverse proxy eliminate the seeding step; deployments where Tautulli has no egress to sensitive internal hosts or cloud metadata endpoints sharply reduce the SSRF impact even if seeding succeeds.

The CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L produces a 9.9 score driven primarily by the Changed scope (the Tautulli host can be coerced into reaching the Plex Media Server or internal infrastructure). PR:L reflects the seeding step that requires a low-privilege guest account, but once the hash is seeded the trigger is fully unauthenticated, which materially increases real-world exposure beyond what PR:L alone implies. EPSS, KEV, SSVC, and POC signals were not supplied in the input, so exploitation probability cannot be quantified; based on available data this is no public exploit identified at time of analysis. The high CVSS is justifiable given the persistent unauthenticated trigger and Changed scope into adjacent Plex hosts, but defenders should note that the attack still depends on the existence of a guest account capable of seeding entries - environments that disable guest signup reduce risk substantially.

An attacker registers or compromises a low-privilege Tautulli guest account and uses the authenticated image-proxy flow to seed a hash entry pointing at an internal target such as http://169.254.169.254/latest/meta-data/ or an internal Plex admin URL. The attacker then logs out and, from any unauthenticated network position, repeatedly requests /image/<hash>.png, causing the Tautulli/Plex host to issue server-side requests to the attacker-chosen URL and return or cache responses. No public POC is referenced in the available data.