FKIE_CVE-2026-43986
Vulnerability from fkie_nvd - Published: 2026-06-04 16:16 - Updated: 2026-07-22 20:10
Severity
Summary
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose a public `/image/<hash>` route that resolves attacker-controlled entries from `image_hash_lookup` and replays them through the same server-side image fetch logic used by authenticated image proxying. A low-privilege guest user can seed a malicious external image URL into this lookup table and then trigger server-side fetches through a fully unauthenticated endpoint. This turns an authenticated SSRF primitive into a persistent unauthenticated SSRF gadget. Once the malicious hash entry exists, any external user can request `/image/<hash>.png` and cause the PMS or Tautulli host to fetch an arbitrary attacker-chosen URL. Version 2.17.1 patches the issue.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"affected": [
{
"affectedData": [
{
"product": "Tautulli",
"vendor": "Tautulli",
"versions": [
{
"status": "affected",
"version": "\u003c 2.17.1"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose a public `/image/\u003chash\u003e` route that resolves attacker-controlled entries from `image_hash_lookup` and replays them through the same server-side image fetch logic used by authenticated image proxying. A low-privilege guest user can seed a malicious external image URL into this lookup table and then trigger server-side fetches through a fully unauthenticated endpoint. This turns an authenticated SSRF primitive into a persistent unauthenticated SSRF gadget. Once the malicious hash entry exists, any external user can request `/image/\u003chash\u003e.png` and cause the PMS or Tautulli host to fetch an arbitrary attacker-chosen URL. Version 2.17.1 patches the issue."
},
{
"lang": "es",
"value": "Tautulli es una herramienta de monitoreo y seguimiento basada en Python para Plex Media Server. Las versiones anteriores a la 2.17.1 exponen una ruta p\u00fablica \u0027/image/ hash \u0027 que resuelve entradas controladas por el atacante de image_hash_lookup y las reproduce a trav\u00e9s de la misma l\u00f3gica de obtenci\u00f3n de im\u00e1genes del lado del servidor utilizada por el proxying de im\u00e1genes autenticado. Un usuario invitado de bajo privilegio puede insertar una URL de imagen externa maliciosa en esta tabla de b\u00fasqueda y luego activar obtenciones del lado del servidor a trav\u00e9s de un endpoint completamente no autenticado. Esto convierte una primitiva SSRF autenticada en un gadget SSRF no autenticado persistente. Una vez que existe la entrada de hash maliciosa, cualquier usuario externo puede solicitar \u0027/image/ hash .png\u0027 y hacer que el host de PMS o Tautulli obtenga una URL arbitraria elegida por el atacante. La versi\u00f3n 2.17.1 corrige el problema."
}
],
"id": "CVE-2026-43986",
"lastModified": "2026-07-22T20:10:00.127",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
"version": "3.1"
},
"exploitabilityScore": 3.1,
"impactScore": 6.0,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-43986",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-04T17:28:57.623297Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-06-04T16:16:38.290",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/Tautulli/Tautulli/security/advisories/GHSA-m6j6-rc2c-8vpm"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"url": "https://github.com/Tautulli/Tautulli/security/advisories/GHSA-m6j6-rc2c-8vpm"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-918"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…