PT-2026-28789 · Tautulli+1 · Tautulli+1

Mandreko · Publicado 2026-03-28 · Atualizado 2026-03-31 · CVE-2026-31804

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tautulli versions prior to 2.17.0

Description Tautulli is a Python-based monitoring and tracking tool for Plex Media Server. The /pms image proxy API endpoint accepts a user-supplied img parameter and forwards it to Plex Media Server’s /photo/:/transcode transcoder without authentication or scheme/host restriction. This endpoint is intentionally excluded from authentication checks. Any value of img starting with http is passed directly to Plex, causing the Plex Media Server process to make an outbound HTTP request to a URL specified by an attacker. The img parameter is vulnerable.

Recommendations Update Tautulli to version 2.17.0 or later.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-31804

GHSA-QJ2F-4C4P-WV97

Produtos afetados

Plex Media Server

Tautulli

Referências · 8

• 🔥 https://github.com/Tautulli/Tautulli/security/advisories/GHSA-qj2f-4c4p-wv97 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31804.json · Exploit
• https://github.com/Tautulli/Tautulli/releases/tag/v2.17.0 · Nota
• https://reddit.com/r/Tautulli/comments/1s5uon8/important_security_update_20260327 · Publicação no Reddit
• https://osv.dev/vulnerability/CVE-2026-31804 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2038916095864955146 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-31804 · Nota de Segurança
• https://twitter.com/infoflowcloud/status/2038918301548523760 · Publicação no Twitter