PT-2026-28791 · Tautulli+1 · Tautulli+1

Mandreko · Published 2026-03-28 · Updated 2026-03-31 · CVE-2026-32275

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Tautulli versions 1.3.10 through 2.16.9

Description Tautulli, a Python-based monitoring tool for Plex Media Server, contains a flaw due to an unsanitized JSONP callback parameter. This allows for cross-origin script injection and potential theft of API keys. The vulnerable parameter is a JSONP callback. Exploitation of this issue could lead to unauthorized access and control of the Plex Media Server through the compromised API key.

Recommendations Update to version 2.17.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-32275

GHSA-95MG-WPQW-9QXH

Affected Products

Plex Media Server

Tautulli

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32275.json · Exploit
• https://github.com/Tautulli/Tautulli/security/advisories/GHSA-95mg-wpqw-9qxh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32275 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32275 · Vendor Advisory
• https://github.com/Tautulli/Tautulli/releases/tag/v2.17.0 · Note
• https://reddit.com/r/Tautulli/comments/1s5uon8/important_security_update_20260327 · Reddit Post
• https://twitter.com/CVEnew/status/2038916093147042231 · Twitter Post