CVE-2026-32275 Details
Description
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 1.3.10 to before version 2.17.0, an unsanitized JSONP callback parameter allows cross-origin script injection and API key theft. This issue has been patched in version 2.17.0.
A vulnerability in Tautulli, a monitoring tool for Plex Media Server, allows for cross-origin script injection and theft of API keys. This issue affects Tautulli versions 1.3.10 prior to 2.17.0. The vulnerability arises from an unsanitized JSONP callback parameter that is directly concatenated into a JavaScript response, enabling the injection of arbitrary scripts. In unauthenticated installations, this exploitation can lead to unauthorized access to the Tautulli API by stealing the API key, which grants full administrative rights.
Users are advised to update Tautulli to version 2.17.0, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Tautulli/Tautulli/releases/tag/v2.17.0 | [email protected] | Release Notes |
| https://github.com/Tautulli/Tautulli/security/advisories/GHSA-95mg-wpqw-9qxh | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| tautulli tautulli | >= 1.3.10, < 2.17.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 2, 2026 | Initial Analysis | [email protected] |
| Apr 1, 2026 | CVE Modified | CISA-ADP |
| Mar 30, 2026 | New CVE Received | [email protected] |