Is CVE-2026-40605 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40605 being exploited in the wild.

How severe is CVE-2026-40605?

Informational severity, with a CVSS score of 5.7, published 4 June 2026.

Is there a fix for CVE-2026-40605?

A patch was published on 2026-05-04: Version 2.17.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40605 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-40605?

Check whether you run Tautulli at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40605: Tautulli path traversal in cache deletion API

CVE-2026-40605 · Severity: info · CVSS 5.7 · Published 2026-06-04

Tautulli, a monitoring tool for Plex Media Server, contains a security flaw in its cache management system. An authorized user or an attacker with an API key can exploit this to delete important folders on the server hosting the application. This could lead to significant data loss, system instability, or a complete shutdown of the monitoring service.

Technologies: Tautulli. Vendors: Tautulli.

Quick answers

Is CVE-2026-40605 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40605 being exploited in the wild.
How severe is CVE-2026-40605?: Informational severity, with a CVSS score of 5.7, published 4 June 2026.
Which products and versions are affected?: Tautulli < 2.17.1.
Is there a fix for CVE-2026-40605?: A patch was published on 2026-05-04: Version 2.17.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40605 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-40605?: Check whether you run Tautulli at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in the Tautulli API's 'delete_cache' command. The 'folder' parameter is used in an 'os.path.join' operation without sufficient validation, allowing an attacker to use '../' sequences to escape the intended cache directory. An authenticated attacker with a valid API key can send a crafted GET request to delete arbitrary directories that the Tautulli process has permissions to modify. This vulnerability was addressed in version 2.17.1 by implementing proper path validation.

Affected products

Tautulli Tautulli < 2.17.1

Timeline

2026-05-04: patched: Version 2.17.1 released
2026-05-27: advisory: GitHub Security Advisory published
2026-06-04: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.