Is CVE-2026-41065 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41065 being exploited in the wild.

How severe is CVE-2026-41065?

Informational severity, with a CVSS score of 8.9, published 4 June 2026.

Is there a fix for CVE-2026-41065?

A patch was published on 2026-05-04: Version 2.17.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41065 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-41065?

Check whether you run Tautulli at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41065: Tautulli remote code execution in newsletter custom template directory

CVE-2026-41065 · Severity: info · CVSS 8.9 · Published 2026-06-04

Tautulli, a monitoring tool for Plex Media Servers, contains a vulnerability that allows attackers to take complete control of the server. On new installations that haven't been fully set up, an attacker can remotely execute malicious commands without any password. On existing installations, a user with administrative privileges can also exploit this flaw to run unauthorized code on the underlying system.

Technologies: Tautulli. Vendors: Tautulli.

Quick answers

Is CVE-2026-41065 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41065 being exploited in the wild.
How severe is CVE-2026-41065?: Informational severity, with a CVSS score of 8.9, published 4 June 2026.
Which products and versions are affected?: Tautulli <= 2.17.0.
Is there a fix for CVE-2026-41065?: A patch was published on 2026-05-04: Version 2.17.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41065 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-41065?: Check whether you run Tautulli at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Tautulli versions prior to 2.17.1 are vulnerable to Remote Code Execution (RCE) due to two compounding issues. First, fresh installations default to an empty password, which disables the authentication middleware for all management endpoints. Second, the 'newsletter_custom_dir' configuration parameter is passed unsanitized to the Mako TemplateLookup engine. An attacker can point this directory to a remote SMB or NFS share containing a malicious Mako template (using <% %> blocks for Python execution) and trigger its rendering via the 'real_newsletter' endpoint. This allows for unauthenticated RCE on new installs and authenticated RCE for administrators on configured installs. The fix in version 2.17.1 introduces anti-CSRF tokens, enforces POST methods, and requires manual configuration to allow mounted folders for templates.

Affected products

Tautulli Tautulli <= 2.17.0

Timeline

2026-05-04: patched: Version 2.17.1 released
2026-05-27: advisory: GitHub Security Advisory published
2026-06-04: disclosed: CVE-2026-41065 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.