PT-2026-28791 · Tautulli+1 · Tautulli+1

Mandreko · Publicado 2026-03-28 · Atualizado 2026-03-31 · CVE-2026-32275

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Tautulli versions 1.3.10 through 2.16.9

Description Tautulli, a Python-based monitoring tool for Plex Media Server, contains a flaw due to an unsanitized JSONP callback parameter. This allows for cross-origin script injection and potential theft of API keys. The vulnerable parameter is a JSONP callback. Exploitation of this issue could lead to unauthorized access and control of the Plex Media Server through the compromised API key.

Recommendations Update to version 2.17.0 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-32275

GHSA-95MG-WPQW-9QXH

Produtos afetados

Plex Media Server

Tautulli

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32275.json · Exploit
• https://github.com/Tautulli/Tautulli/releases/tag/v2.17.0 · Nota
• https://github.com/Tautulli/Tautulli/security/advisories/GHSA-95mg-wpqw-9qxh · Aviso do Fabricante
• https://reddit.com/r/Tautulli/comments/1s5uon8/important_security_update_20260327 · Publicação no Reddit
• https://nvd.nist.gov/vuln/detail/CVE-2026-32275 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-32275 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2038916093147042231 · Publicação no Twitter