CVE-2026-31804: Tautulli: Unauthenticated pms_image_proxy endpoint proxies arbitrary HTTP requests through the Plex Media Server
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /pmsimageproxy endpoint accepts a user-supplied img parameter and forwards it to Plex Media Server's /photo/:/ transcode transcoder without authentication and without restricting the scheme or host. The endpoint is intentionally excluded from all authentication checks in webstart.py, any value of img beginning with http is passed directly to Plex, this causes the Plex Media Server process, which typically runs on the same host or internal network as Tautulli, with access to RFC-1918 address space, to issue an outbound HTTP request to any attacker-specified URL. This issue has been patched in version 2.17.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31804?
CVE-2026-31804 is considered a high severity vulnerability due to its potential for unauthenticated access leading to arbitrary HTTP request proxying.
How do I fix CVE-2026-31804?
To fix CVE-2026-31804, upgrade Tautulli to version 2.17.0 or later, which addresses this vulnerability.
What are the potential impacts of CVE-2026-31804?
The potential impacts of CVE-2026-31804 include unauthorized disclosure of sensitive information and exploitation of the Plex Media Server functionality.
Which versions of Tautulli are affected by CVE-2026-31804?
Tautulli versions prior to 2.17.0 are affected by CVE-2026-31804.
Is authentication required to exploit CVE-2026-31804?
No, CVE-2026-31804 can be exploited without any authentication.