CVE-2026-129165: Tactical RMM 0.17.0 through 1.6.1 Arbitrary File Read via Report Preview
Published Nov 13, 2026
·Updated
Tactical RMM 0.17.0 through 1.6.1 contains an arbitrary file read in the /reporting/templates/preview/ endpoint because WeasyPrint resolves file:// links in user-supplied templatemd and embeds the files in the returned PDF. Users with report management permission can read the Django SECRETKEY, reused as the NATS password, and publish runscript commands to every managed agent.
Affected Software
1 affected component
Tactical RMM Tactical RMM>=0.17.0<=1.6.1
Event History
Nov 13, 2026
CVE Published
via MITRE·05:21 PM
Data Sourced
via MITRE·05:21 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:17 PM
DescriptionSeverityWeakness