CVE-2026-43986 Details
Description
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose a public `/image/<hash>` route that resolves attacker-controlled entries from `image_hash_lookup` and replays them through the same server-side image fetch logic used by authenticated image proxying. A low-privilege guest user can seed a malicious external image URL into this lookup table and then trigger server-side fetches through a fully unauthenticated endpoint. This turns an authenticated SSRF primitive into a persistent unauthenticated SSRF gadget. Once the malicious hash entry exists, any external user can request `/image/<hash>.png` and cause the PMS or Tautulli host to fetch an arbitrary attacker-chosen URL. Version 2.17.1 patches the issue.
A persistent unauthenticated server-side request forgery (SSRF) vulnerability has been identified in Tautulli versions prior to 2.17.1. The issue arises from a public `/image/<hash>` route that allows low-privilege guest users to manipulate image hash lookups. By seeding a malicious external image URL, an attacker can exploit the server-side image fetching logic, turning an authenticated SSRF vulnerability into a persistent, unauthenticated one. Once the malicious hash is created, any external user can trigger the fetch through the public endpoint, causing the Tautulli or Plex Media Server host to retrieve an arbitrary URL of the attacker's choice.
Users can update to Tautulli version 2.17.1, which addresses this vulnerability by removing the ability to store image hashes for external images.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 4, 2026CISA-ADP
Assessed Jun 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Tautulli/Tautulli/security/advisories/GHSA-m6j6-rc2c-8vpm | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1 | [email protected] | Release NotesVendor |
| https://github.com/Tautulli/Tautulli/security/advisories/GHSA-m6j6-rc2c-8vpm | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tautulli | <= 2.17.0 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 4, 2026 | CVE Modified | CISA-ADP |
| Jun 4, 2026 | New CVE Received | [email protected] |