CVE-2026-43986
Tautulli, a Python tool for monitoring Plex Media Server, has a critical flaw that lets anyone fetch arbitrary URLs from the server. The vulnerability is an unauthenticated Server‑Side Request Forgery (SSRF) that can be triggered via a public image endpoint. It was fixed in version 2.17.1.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Tautulli versions before 2.17.1, used by Plex Media Server administrators.
Real-world impact
An attacker can make the Tautulli host fetch any external URL, potentially accessing internal resources, exfiltrating data, or performing other malicious actions.
Why this severity
The CVSS score of 9.9 reflects the low effort required, the ability to act without authentication, and the high impact on confidentiality and integrity.
What to do about it
- 01Upgrade Tautulli to version 2.17.1 or later.
- 02Restart the Tautulli service to apply the update.
NVD-referenced vendor advisory
Timeline
- Jun 4, 2026 · Jun 4, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.
- Jul 24, 2026 · 11d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.