CVE-2026-49995: Tautulli: Stored Cross-Site Scripting (XSS) in the newsletter
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the newsletter cron field stored in the newsletters table is inserted by data/interfaces/default/newsletterconfig.html into a JavaScript string without safe JSON encoding. An administrator or caller with the Tautulli API key can store a crafted cron value, and an administrator who later opens the newsletter configuration modal passively triggers script execution in the Tautulli web context. The stored value persists in the database and can continue to execute after credential rotation until it is removed. This issue is fixed in version 2.17.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tautullito a version that resolves this vulnerability.Fixed in 2.17.2 - Operational
Remove any crafted persisted newsletter cron payload stored in the Tautulli newsletters table; note the malicious value can continue to execute after credential rotation until it is removed.
Event History
Frequently Asked Questions
Who can inject the malicious value, and who triggers it?
An administrator or a caller with the Tautulli API key can store a crafted newsletter cron value. Script execution occurs when an administrator later opens the newsletter configuration modal.
Which deployments are affected?
Tautulli versions prior to 2.17.2 are affected. The issue involves the newsletter cron field stored in the newsletters table.
What should be done if upgrading cannot happen immediately?
Remove any untrusted or suspicious values from the newsletter cron field in the newsletters table. Rotating credentials alone does not remove the stored payload, which can continue executing until it is removed.
How can I determine whether a stored payload may still be present?
Inspect newsletter cron values in the newsletters table for crafted or unexpected content. A payload may execute when an administrator opens the newsletter configuration modal, even if credentials have since been rotated.