Python-Based Monitoring Tool Tautulli Vulnerability in Notification Handling
CVE-2026-28505

7.5HIGH

Key Information:

Vendor

Tautulli

Status
Tautulli
Vendor
CVE Published:
30 March 2026

What is CVE-2026-28505?

Tautulli, a monitoring tool for Plex Media Server, had a vulnerability in its notification handling mechanism prior to version 2.17.0. The issue was rooted in the str_eval() function of notification_handler.py, which utilized a sandboxed eval() for processing notification text templates. The sandbox had limitations in its checks, only examining code.co_names from the outer code object. Consequently, when a lambda expression was utilized, it generated a nested code object that stored attribute accesses in code.co_consts, bypassing the sandbox's inspection. This flaw meant that nested code objects were not adequately scrutinized, potentially leading to unintended code execution. The issue was addressed in version 2.17.0.

Affected Version(s)

Tautulli < 2.17.0

References

https://github.com/Tautulli/Tautulli/security/advisories/...
x_refsource_CONFIRM
https://github.com/Tautulli/Tautulli/releases/tag/v2.17.0
x_refsource_MISC

CVSS V4

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.