CVE-2026-31799: Tautulli: SQL Injection in get_home_stats API endpoint via unsanitised filter parameters
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 2.14.2 to before version 2.17.0 for parameters "before" and "after" and from version 2.1.0-beta to before version 2.17.0 for parameters "sectionid" and "userid", the /api/v2?cmd=gethomestats endpoint passes the sectionid, userid, before, and after query parameters directly into SQL via Python %-string formatting without parameterization. An attacker who holds the Tautulli admin API key can inject arbitrary SQL and exfiltrate any value from the Tautulli SQLite database via boolean-blind inference. This issue has been patched in version 2.17.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31799?
CVE-2026-31799 has been rated as a high severity vulnerability due to its potential for SQL Injection attacks.
How do I fix CVE-2026-31799?
To fix CVE-2026-31799, upgrade Tautulli to version 2.17.0 or later.
What versions are affected by CVE-2026-31799?
CVE-2026-31799 affects Tautulli versions from 2.14.2 up to, but not including, 2.17.0 as well as versions from 2.1.0-beta to before 2.17.0.
What type of attack does CVE-2026-31799 enable?
CVE-2026-31799 enables SQL Injection attacks through the unsanitised filter parameters in the get_home_stats API endpoint.
Is authentication required to exploit CVE-2026-31799?
No, CVE-2026-31799 can be exploited without authentication if the API endpoint is accessible.