CVE-2026-43985: Taultulli has CSRF in /configUpdate via missing anti-CSRF and method restriction that allows admin credential takeover

Synopsis

Cross-site request forgery (CSRF) in Tautulli allows a remote attacker to overwrite the administrator username and password without any prior authentication. The attack is delivered over the network and requires a logged-in Tautulli administrator to visit a malicious page, which then silently submits a crafted request to the unprotected /configUpdate endpoint. Successful exploitation gives the attacker full administrative access to the Tautulli interface. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious page over the network and the cross-site request targets a Tautulli instance reachable from the victim's browser, so network exposure is necessary for the attack to succeed.

• AuthenticationNot required

  The attacker needs no credentials of their own; the attack piggybacks on the victim administrator's existing authenticated session cookie.

• Victim interactionRequired

  A logged-in Tautulli administrator must be lured to visit a malicious web page that issues the cross-site request, making social engineering a prerequisite.

• Attack complexityDetail

  Exploit conditions are straightforward and require no race conditions or special environmental setup; a simple malicious page is sufficient to trigger the request.

Blast Radius

• Attacker overwrites the Tautulli administrator username and password with attacker-chosen values.
• Attacker then signs in directly with the new credentials and controls the full Tautulli administrative interface.
• From the admin interface, the attacker can read Plex library metadata, playback history, and any stored API tokens or integration credentials configured in Tautulli.
• The attacker can modify Tautulli notification agents, webhooks, and scripts, enabling further lateral movement or persistent access into connected systems.