How severe is CVE-2026-31804?

CVE-2026-31804 has a CVSS 3.x base score of 4.0, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2026-31804 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-31804?

CVE-2026-31804 affects Tautulli. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-31804?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-31804 have an EU (EUVD) identifier?

Yes. CVE-2026-31804 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-17190.

When was CVE-2026-31804 published?

CVE-2026-31804 was published on 2026-03-30 and last updated on 2026-06-17.

CVE-2026-31804

CVE-2026-31804 is a medium-severity vulnerability in Tautulli with a CVSS 3.x base score of 4.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-918.

Key facts

Severity: Medium (CVSS 3.x base score 4.0)
EPSS exploit prediction: 0% (20th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-17190
Weakness: CWE-918
Affected product: Tautulli
Published: 2026-03-30
Last modified: 2026-06-17

Description

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /pms_image_proxy endpoint accepts a user-supplied img parameter and forwards it to Plex Media Server's /photo/:/ transcode transcoder without authentication and without restricting the scheme or host. The endpoint is intentionally excluded from all authentication checks in webstart.py, any value of img beginning with http is passed directly to Plex, this causes the Plex Media Server process, which typically runs on the same host or internal network as Tautulli, with access to RFC-1918 address space, to issue an outbound HTTP request to any attacker-specified URL. This issue has been patched in version 2.17.0.

Frequently asked questions

What is CVE-2026-31804?: Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /pms_image_proxy endpoint accepts a user-supplied img parameter and forwards it to Plex Media Server's /photo/:/ transcode transcoder without authentication and without restricting the scheme or host. The endpoint is intentionally excluded from all authentication checks in webstart.py, any value of img beginning with http is passed directly to Plex, this causes the Plex Media Server process, which typically runs on the same host or internal network as Tautulli, with access to RFC-1918 address space, to issue an outbound HTTP request to any attacker-specified URL. This issue has been patched in version 2.17.0.
How severe is CVE-2026-31804?: CVE-2026-31804 has a CVSS 3.x base score of 4.0, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2026-31804 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-31804?: CVE-2026-31804 affects Tautulli. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-31804?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-31804 have an EU (EUVD) identifier?: Yes. CVE-2026-31804 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-17190.
When was CVE-2026-31804 published?: CVE-2026-31804 was published on 2026-03-30 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:tautulli:tautulli:*:*:*:*:*:*:*:*

More vulnerabilities in Tautulli

CVE-2026-28505 — Critical (CVSS 10.0): Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the str_eval()…
CVE-2026-32275 — Critical (CVSS 9.1): Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 1.3.10 to before version…
CVE-2025-58762 — Critical (CVSS 9.1): Tautulli is a Python based monitoring and tracking tool for Plex Media Server. In Tautulli v2.15.3 and earlier, an…
CVE-2025-58761 — High (CVSS 8.6): Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The `real_pms_image_proxy` endpoint in…
CVE-2025-58760 — High (CVSS 8.6): Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The `/image` API endpoint in Tautulli…
CVE-2025-58763 — High (CVSS 8.0): Tautulli is a Python based monitoring and tracking tool for Plex Media Server. A command injection vulnerability in…

All CVEs affecting Tautulli →

Other CWE-918 (Server-Side Request Forgery (SSRF)) vulnerabilities

CVE-2026-47938 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by a Server-Side Request Forgery (SSRF)…
CVE-2026-35431 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to…
CVE-2026-32186 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to elevate privileges over a…
CVE-2026-33107 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Azure Databricks allows an unauthorized attacker to elevate privileges over a…
CVE-2026-32871 — Critical (CVSS 10.0): FastMCP is a Pythonic way to build MCP servers and clients. Prior to version 3.2.0, the OpenAPIProvider in FastMCP…
CVE-2026-32169 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Azure Cloud Shell allows an unauthorized attacker to elevate privileges over a…

Browse all CWE-918 (Server-Side Request Forgery (SSRF)) vulnerabilities →