CVE-2026-41065: Tautulli Vulnerable to Unauthenticated/Authenticated Remote Code Execution via Newsletter Custom Template Directory

Synopsis

A remote code execution vulnerability exists in Tautulli, a Python-based monitoring tool for Plex Media Server, affecting all versions prior to 2.17.1. The flaw is reachable over the network and, on a fresh install before the setup wizard is completed, requires no credentials whatsoever; on a completed install, any admin account is sufficient to trigger it. Successful exploitation gives an attacker full code execution on the host running Tautulli. No fix version has been published upstream yet, and HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable newsletter render endpoint is exposed over the network, so an attacker must be able to reach the Tautulli HTTP interface from the internet or local network.

• AuthenticationNot required

  On a fresh install before the setup wizard is completed, all management endpoints are fully unauthenticated, meaning no credentials of any kind are needed to execute the full attack chain.

• Victim interactionNot required

  The attacker triggers execution entirely by calling the newsletter render endpoint directly; no user action or click is required.

• Attack complexityDetail

  The exploit is reliable and condition-free once the attacker can reach the service, with no race conditions, memory layout dependencies, or other environmental factors to overcome.

Blast Radius

• The attacker executes arbitrary code in the security context of the Tautulli process on the host, giving them the ability to run any command available to that user.
• All data accessible to the Tautulli process is exposed, including Plex authentication tokens, API keys, and any stored user or playback history records.
• The attacker can modify or delete Tautulli configuration, logs, and persisted data on disk.
• The running Tautulli service can be crashed or made unavailable, interrupting monitoring and alerting for the associated Plex Media Server.