CVE-2026-41065: Tautulli Vulnerable to Unauthenticated/Authenticated Remote Code Execution via Newsletter Custom Template Directory
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 are vulnerable to remote code execution via the newsletter custom template directory feature. On a fresh install before the setup wizard is completed, all management endpoints are completely unauthenticated. An attacker can create a newsletter agent, point the custom template directory to an attacker-controlled SMB share serving a malicious Mako template, and trigger execution via the newsletter render endpoint, all with zero credentials and no local access to the target system. On a completed install with credentials configured, the same chain is exploitable by any admin. Version 2.17.1 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tautullito a version that resolves this vulnerability.Fixed in 2.17.1 - Compensating control
For fresh installs where the setup wizard is not completed, restrict/disable access to all management endpoints until authentication is enabled (management endpoints are described as completely unauthenticated before setup wizard completion).
- Compensating control
For installed systems, restrict/limit access so that only authenticated admins can reach the newsletter render endpoint and related management functions, since the described exploit is exploitable by any admin after credentials are configured.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41065?
CVE-2026-41065 has a severity rating of high with a CVSS score of 8.9.
How do I fix CVE-2026-41065?
To fix CVE-2026-41065, upgrade your Tautulli installation to version 2.17.1 or later.
What type of vulnerability is CVE-2026-41065?
CVE-2026-41065 is a remote code execution vulnerability found in Tautulli.
Who is affected by CVE-2026-41065?
All versions of Tautulli prior to 2.17.1 are affected by CVE-2026-41065.
Can CVE-2026-41065 be exploited remotely?
Yes, CVE-2026-41065 can be exploited remotely via the newsletter custom template directory feature.