Remote Code Execution in Tautulli via Malicious Mako Template

Compliance Impact

The vulnerability allows remote code execution with zero credentials on fresh installs and by any admin on completed installs, potentially leading to unauthorized access and control over the Tautulli server.

Such unauthorized access and execution could result in exposure or manipulation of sensitive data, which may impact compliance with data protection regulations like GDPR or HIPAA that require strict controls over data confidentiality and integrity.

However, the provided information does not explicitly mention compliance impacts or regulatory considerations.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-41065 is a remote code execution vulnerability in Tautulli versions 2.17.0 and earlier. It arises because fresh installations have no authentication on management endpoints, and the newsletter custom template directory feature allows setting arbitrary paths without validation. An attacker can create a newsletter agent, point the custom template directory to a malicious template hosted on an attacker-controlled SMB or NFS share, and trigger code execution via the newsletter render endpoint without any credentials. On completed installations, any admin can exploit the same chain.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to execute arbitrary code remotely as the Tautulli process user. On fresh installs, this can be done without any credentials, potentially giving full control over the affected system. On completed installs, any admin user can exploit it to run malicious code. This could lead to system compromise, data theft, or further attacks within the network.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves checking if the Tautulli installation is running a version prior to 2.17.1 and whether the setup wizard has been completed. On fresh installs before setup completion, management endpoints are unauthenticated, which can be tested by attempting to access newsletter management endpoints without credentials.

Additionally, monitoring network traffic for SMB or NFS connections initiated by the Tautulli server to external shares could indicate exploitation attempts, as the vulnerability involves loading malicious Mako templates from attacker-controlled SMB or NFS shares.

Suggested commands include:

• Check Tautulli version: `tautulli --version` or check the installed package version.
• Test unauthenticated access to management endpoints (on fresh installs): Use curl or wget to access newsletter endpoints without credentials, e.g., `curl http://<tautulli-server>:<port>/newsletter/render`.
• Monitor network connections for SMB (Windows) or NFS (Linux) shares: Use tools like `netstat -an | grep 445` (SMB) or `showmount -e` (NFS) to detect unusual mounts or connections.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Tautulli to version 2.17.1 or later, as this version contains the fix for the vulnerability.

For fresh installations, complete the setup wizard promptly to enable authentication and prevent unauthenticated access to management endpoints.

Restrict network access to the Tautulli server, especially blocking SMB and NFS traffic from untrusted sources to prevent loading of malicious templates.

Review and restrict admin privileges to trusted users only, as exploitation on completed installs requires admin credentials.

Useful 0 Not Useful 0