PT-2026-28789 · Tautulli+1 · Tautulli+1

Mandreko · Published 2026-03-28 · Updated 2026-03-31 · CVE-2026-31804

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tautulli versions prior to 2.17.0

Description Tautulli is a Python-based monitoring and tracking tool for Plex Media Server. The /pms image proxy API endpoint accepts a user-supplied img parameter and forwards it to Plex Media Server’s /photo/:/transcode transcoder without authentication or scheme/host restriction. This endpoint is intentionally excluded from authentication checks. Any value of img starting with http is passed directly to Plex, causing the Plex Media Server process to make an outbound HTTP request to a URL specified by an attacker. The img parameter is vulnerable.

Recommendations Update Tautulli to version 2.17.0 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-31804

GHSA-QJ2F-4C4P-WV97

Affected Products

Plex Media Server

Tautulli

References · 8

• 🔥 https://github.com/Tautulli/Tautulli/security/advisories/GHSA-qj2f-4c4p-wv97 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31804.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-31804 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31804 · Security Note
• https://github.com/Tautulli/Tautulli/releases/tag/v2.17.0 · Note
• https://reddit.com/r/Tautulli/comments/1s5uon8/important_security_update_20260327 · Reddit Post
• https://twitter.com/CVEnew/status/2038916095864955146 · Twitter Post
• https://twitter.com/infoflowcloud/status/2038918301548523760 · Twitter Post