# CVE-2026-41065: Tautulli remote code execution in newsletter custom template directory

Source: https://junglewise.ai/threats/cve-2026-41065-tautulli-remote-code-execution-in-newsletter-custom-template  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-04. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

CVE-2026-41065 · Severity: info · CVSS 8.9 · Published 2026-06-04

Tautulli, a monitoring tool for Plex Media Servers, contains a vulnerability that allows attackers to take complete control of the server. On new installations that haven't been fully set up, an attacker can remotely execute malicious commands without any password. On existing installations, a user with administrative privileges can also exploit this flaw to run unauthorized code on the underlying system.

Technologies: [Tautulli](https://junglewise.ai/threats/technologies/tautulli). Vendors: [Tautulli](https://junglewise.ai/threats/vendors/tautulli).

## Quick answers

**Is CVE-2026-41065 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41065 being exploited in the wild.

**How severe is CVE-2026-41065?** Informational severity, with a CVSS score of 8.9, published 4 June 2026.

**Which products and versions are affected?** Tautulli <= 2.17.0.

**Is there a fix for CVE-2026-41065?** A patch was published on 2026-05-04: Version 2.17.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41065 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-41065?** Check whether you run Tautulli at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Tautulli versions prior to 2.17.1 are vulnerable to Remote Code Execution (RCE) due to two compounding issues. First, fresh installations default to an empty password, which disables the authentication middleware for all management endpoints. Second, the 'newsletter_custom_dir' configuration parameter is passed unsanitized to the Mako TemplateLookup engine. An attacker can point this directory to a remote SMB or NFS share containing a malicious Mako template (using <% %> blocks for Python execution) and trigger its rendering via the 'real_newsletter' endpoint. This allows for unauthenticated RCE on new installs and authenticated RCE for administrators on configured installs. The fix in version 2.17.1 introduces anti-CSRF tokens, enforces POST methods, and requires manual configuration to allow mounted folders for templates.

## Affected products

- Tautulli Tautulli <= 2.17.0

## Timeline

- 2026-05-04: patched: Version 2.17.1 released
- 2026-05-27: advisory: GitHub Security Advisory published
- 2026-06-04: disclosed: CVE-2026-41065 published to NVD

## References

- [https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1](https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1)
- [https://github.com/Tautulli/Tautulli/security/advisories/GHSA-68qx-mcf5-3jcp](https://github.com/Tautulli/Tautulli/security/advisories/GHSA-68qx-mcf5-3jcp)

## Related threats

- [Tautulli open redirect via whitespace bypass in /auth/redirect](https://junglewise.ai/threats/cve-2026-54915-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex)
- [Tautulli path traversal in file upload handlers](https://junglewise.ai/threats/cve-2026-52835-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex)
- [Tautulli stored XSS in newsletter cron field](https://junglewise.ai/threats/cve-2026-49995-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex)
- [Tautulli reflected XSS in search query](https://junglewise.ai/threats/cve-2026-45381-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex)
- [Tautulli unauthenticated SSRF in image route](https://junglewise.ai/threats/cve-2026-43986-tautulli-unauthenticated-ssrf-in-image-route)