Tautulli v2.17.1 RCE (CVE-2026-41065) and Security Fixes Advisory

Vulnerability Overview A remote code execution vulnerability (CVE-2026-41065) was discovered in Tautulli version v2.17.1. The vulnerability exists within the newsletter custom template directory, allowing attackers to execute arbitrary code by constructing malicious template files. Affected Scope Affected Version: Tautulli v2.17.1 Vulnerability Type: Remote Code Execution (RCE) Vulnerability Source: Newsletter custom template directory Remediation Status: Fixed Fixed Version: Tautulli v2.17.1 Remediation Measures: Security hardening has been applied to the newsletter custom template directory to prevent remote code execution. POC or Exploit Code No specific POC code or exploit code is provided on the page. Additional Information Reporter: @remindsec Release Date: 2026-05-04 Other Fixes: - Fixed issue with Tautulli Remote App notification sending failures. - Fixed failure when the logo/square art key was included during export. - Fixed errors when browsing folder paths. - Added AV1 and opus media flag images. - Cleaned up empty directories remaining after updates using git. - Fixed an issue where Tautulli could not reconnect to the Plex Media Server upon restart after a connection loss. - Fixed a path traversal vulnerability in the cache deletion API (CVE-2026-40605). - Fixed an issue where WebSockets did not terminate when changing the Plex server. - Fixed JS log errors to prevent XSS (CVE-2026-43964). - Updated Windows and MacOS packages to Python 3.13. - Updated Snap package to core24. - Added new templates and scripts, requiring manual enabling of . - Added anti-CSRF tokens and enforced the POST method on status change endpoints (CVE-2026-43985). - Hashed the Tautulli cookie name; all existing login sessions will become invalid after the update. - Required the X-API-Key header when logging in via the endpoint. Contributors Main Contributor: JonnyWong16 Other Contributors: remindsec, little0831, JakePeralta7, larlarua Assets Download Links: - Tautulli-macos-v2.17.1-universal.pkg - Tautulli-windows-v2.17.1-x64.exe Reactions All Reactions: 10 reactions Footer Information Copyright: © 2026 GitHub, Inc. Links: Terms, Privacy, Security, Status, Community, Docs, Contact, Manage cookies, Do not share my personal information.

Goal Reached Thanks to every supporter — we hit 100%!

Tautulli v2.17.1 RCE (CVE-2026-41065) and Security Fixes Advisory

More from this source