PT-2026-28788 · Tautulli+1 · Tautulli+1

Mandreko · Published 2026-03-28 · Updated 2026-03-31 · CVE-2026-31799

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tautulli versions 2.14.2 through 2.16.9 Tautulli versions 2.1.0-beta through 2.16.9

Description Tautulli is a Python-based monitoring and tracking tool for Plex Media Server. The /api/v2?cmd=get home stats API endpoint directly passes the section id, user id, before, and after query parameters into SQL using Python %-string formatting without parameterization. An attacker with the Tautulli administrator API key can inject arbitrary SQL and extract any data from the Tautulli SQLite database using boolean-blind inference. The vulnerable parameters are section id, user id, before, and after.

Recommendations Tautulli versions 2.14.2 through 2.16.9: Upgrade to version 2.17.0 or later. Tautulli versions 2.1.0-beta through 2.16.9: Upgrade to version 2.17.0 or later.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-20

CWE-89

Related Identifiers

CVE-2026-31799

GHSA-G47Q-8J8W-M63Q

Affected Products

Plex Media Server

Tautulli

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31799.json · Exploit
• https://github.com/Tautulli/Tautulli/security/advisories/GHSA-g47q-8j8w-m63q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31799 · Security Note
• https://osv.dev/vulnerability/CVE-2026-31799 · Vendor Advisory
• https://github.com/Tautulli/Tautulli/releases/tag/v2.17.0 · Note
• https://twitter.com/CVEnew/status/2038916094057214026 · Twitter Post
• https://reddit.com/r/Tautulli/comments/1s5uon8/important_security_update_20260327 · Reddit Post