CVE-2026-40605

Tautulli versions prior to 2.17.1 expose a public `/image/<hash>` route that resolves attacker-controlled entries from `image_hash_lookup` and replays them through server-side image fetch logic. A low-privilege guest user can seed a malicious external image URL into this lookup table and trigger server-side fetches through an unauthenticated endpoint, turning an authenticated SSRF primitive into a persistent unauthenticated SSRF gadget.

Tautulli versions prior to 2.17.1 do not enforce POST method on the `configUpdate` endpoint and lack anti-CSRF tokens. An attacker can trick a logged-in administrator into visiting a malicious page that submits a cross-site request, overwriting the admin username and password, leading to administrative interface takeover.

Tautulli is a monitoring tool for Plex Media Server. Prior to 2.17.1, the `log_js_errors` endpoint is accessible to any authenticated user, including guests. It writes attacker-controlled strings to the application log. The admin-only `logFile` view reads the log and embeds it into HTML without escaping, causing stored XSS. A guest can inject HTML/JavaScript that executes in an administrator's browser.

Tautulli prior to 2.17.1 is vulnerable to remote code execution via the newsletter custom template directory feature. On a fresh install before setup wizard completion, all management endpoints are unauthenticated. An attacker can create a newsletter agent, point the template directory to a malicious SMB share with a Mako template, and trigger execution via the newsletter render endpoint.