CVE-2026-41065 Details
Description
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 are vulnerable to remote code execution via the newsletter custom template directory feature. On a fresh install before the setup wizard is completed, all management endpoints are completely unauthenticated. An attacker can create a newsletter agent, point the custom template directory to an attacker-controlled SMB share serving a malicious Mako template, and trigger execution via the newsletter render endpoint, all with zero credentials and no local access to the target system. On a completed install with credentials configured, the same chain is exploitable by any admin. Version 2.17.1 fixes the issue.
A remote code execution vulnerability exists in Tautulli versions prior to 2.17.1, through the newsletter custom template directory feature. On a fresh installation, before completing the setup wizard, all management endpoints are unauthenticated. An attacker can create a newsletter agent, direct the custom template directory to an attacker-controlled SMB share hosting a malicious Mako template, and execute arbitrary code via the newsletter render endpoint, without any credentials or local access to the system. In completed installations with configured credentials, the same exploitation chain is available to any admin.
Users can update to Tautulli version 2.17.1, which addresses the vulnerability by fixing the remote code execution issue via the newsletter custom template directory.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 4, 2026CISA-ADP
Assessed Jun 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Tautulli/Tautulli/security/advisories/GHSA-68qx-mcf5-3jcp | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1 | [email protected] | Release NotesVendor |
| https://github.com/Tautulli/Tautulli/security/advisories/GHSA-68qx-mcf5-3jcp | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1336 | Improper Neutralization of Special Elements Used in a Template Engine | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tautulli | <= 2.17.0 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 4, 2026 | CVE Modified | CISA-ADP |
| Jun 4, 2026 | New CVE Received | [email protected] |