CVE-2026-43985: Taultulli has CSRF in /configUpdate via missing anti-CSRF and method restriction that allows admin credential takeover
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose configUpdate as a state-changing administrator endpoint, but the route does not enforce POST and does not use any anti-CSRF token. In the default form and JWT-based authentication mode, the administrator session cookie is issued with SameSite=Lax, which still permits top-level cross-site navigation requests. An attacker can exploit this by luring a logged-in administrator to a malicious page that submits a cross-site request to /configUpdate and overwrites the local administrator username and password. The attacker can then sign in directly with the chosen credentials and take over the Tautulli administrative interface. Version 2.17.1 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tautullito a version that resolves this vulnerability.Fixed in 2.17.1 - Configuration
Ensure the /configUpdate endpoint enforces the POST method for state changes (versions prior to 2.17.1 did not enforce POST).
Tautulli /configUpdate HTTP method enforcement = POST only - Configuration
Add/require anti-CSRF tokens for the /configUpdate endpoint (versions prior to 2.17.1 did not use any anti-CSRF token).
Tautulli /configUpdate anti-CSRF protection = required - Configuration
Reconfigure the administrator session cookie to prevent cross-site navigation from issuing authenticated requests (material states default/JWT mode uses SameSite=Lax, which allows top-level cross-site navigation).
Tautulli admin session cookie SameSite = Lax
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43985?
CVE-2026-43985 has a high severity rating of 8.8.
How do I fix CVE-2026-43985?
To fix CVE-2026-43985, upgrade Tautulli to version 2.17.1 or later.
What type of vulnerability is CVE-2026-43985?
CVE-2026-43985 is a Cross-Site Request Forgery (CSRF) vulnerability.
What could be the impact of CVE-2026-43985?
The impact of CVE-2026-43985 allows for admin credential takeover due to the missing anti-CSRF token.
Which versions of Tautulli are affected by CVE-2026-43985?
Versions of Tautulli prior to 2.17.1 are affected by CVE-2026-43985.