Tautulli vulnerable to unauthenticated SSRF in /image/<hash> via attacker-seeded image hash replay
CVE-2026-43986

9.9CRITICAL

Key Information:

Vendor

Tautulli

Status
Tautulli
Vendor
CVE Published:
4 June 2026

What is CVE-2026-43986?

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose a public /image/<hash> route that resolves attacker-controlled entries from image_hash_lookup and replays them through the same server-side image fetch logic used by authenticated image proxying. A low-privilege guest user can seed a malicious external image URL into this lookup table and then trigger server-side fetches through a fully unauthenticated endpoint. This turns an authenticated SSRF primitive into a persistent unauthenticated SSRF gadget. Once the malicious hash entry exists, any external user can request /image/<hash>.png and cause the PMS or Tautulli host to fetch an arbitrary attacker-chosen URL. Version 2.17.1 patches the issue.

Affected Version(s)

Tautulli < 2.17.1

References

https://github.com/Tautulli/Tautulli/security/advisories/...
x_refsource_CONFIRM
https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1
x_refsource_MISC

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.