CVE-2026-31799 Details
Description
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 2.14.2 to before version 2.17.0 for parameters "before" and "after" and from version 2.1.0-beta to before version 2.17.0 for parameters "section_id" and "user_id", the /api/v2?cmd=get_home_stats endpoint passes the section_id, user_id, before, and after query parameters directly into SQL via Python %-string formatting without parameterization. An attacker who holds the Tautulli admin API key can inject arbitrary SQL and exfiltrate any value from the Tautulli SQLite database via boolean-blind inference. This issue has been patched in version 2.17.0.
A SQL injection vulnerability has been identified in Tautulli, a monitoring tool for Plex Media Server, affecting versions 2.14.2 prior to 2.17.0, and versions 2.1.0-beta prior to 2.17.0. The vulnerability arises in the '/api/v2?cmd=get_home_stats' endpoint, where the 'section_id', 'user_id', 'before', and 'after' query parameters are passed directly into SQL queries via Python '%'-string formatting, without proper parameterization. This flaw allows an attacker with a Tautulli admin API key to inject arbitrary SQL and exfiltrate data from the Tautulli SQLite database using boolean-blind inference.
Users are advised to update Tautulli to version 2.17.0, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Tautulli/Tautulli/releases/tag/v2.17.0 | [email protected] | Release Notes |
| https://github.com/Tautulli/Tautulli/security/advisories/GHSA-g47q-8j8w-m63q | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| tautulli tautulli | >= 2.1.0, < 2.17.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 2, 2026 | Initial Analysis | [email protected] |
| Mar 30, 2026 | New CVE Received | [email protected] |