# CVE-2026-43985: Tautulli CSRF in configUpdate allows administrator takeover

Source: https://junglewise.ai/threats/cve-2026-43985-tautulli-csrf-in-configupdate-allows-administrator-takeover  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-04. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

CVE-2026-43985 · Severity: high · CVSS 8.8 · Published 2026-06-04

Tautulli is a monitoring and management tool for Plex Media Server. A security flaw allows an attacker to trick a logged-in administrator into visiting a malicious website that silently changes the administrator's username and password. This results in a complete takeover of the Tautulli management interface, allowing the attacker to access sensitive logs, configuration data, and server settings.

Technologies: [Tautulli](https://junglewise.ai/threats/technologies/tautulli). Vendors: [Tautulli](https://junglewise.ai/threats/vendors/tautulli).

## Quick answers

**Is CVE-2026-43985 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43985 being exploited in the wild.

**How severe is CVE-2026-43985?** High severity, with a CVSS score of 8.8, published 4 June 2026.

**Which products and versions are affected?** Tautulli < 2.17.1.

**Is there a fix for CVE-2026-43985?** A patch was published on 2026-05-04: Version 2.17.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-43985 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-43985?** Check whether you run Tautulli at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the `/configUpdate` endpoint of Tautulli. The endpoint, which handles sensitive configuration changes including administrator credentials, fails to enforce the POST method and lacks anti-CSRF tokens. Furthermore, the application issues JWT session cookies with `SameSite=Lax`, which permits top-level cross-site GET requests to carry the session cookie. An attacker can lure an authenticated administrator to a malicious site that triggers a request to `/configUpdate` with new `http_username` and `http_password` parameters. This overwrites the local administrator credentials in the configuration file, allowing the attacker to subsequently log in with full administrative privileges. The issue is fixed in version 2.17.1 by enforcing POST methods and implementing anti-CSRF tokens.

## Affected products

- Tautulli Tautulli < 2.17.1

## Timeline

- 2026-05-04: patched: Version 2.17.1 released
- 2026-05-27: advisory: GitHub Security Advisory published
- 2026-06-04: disclosed: CVE published to NVD

## References

- [https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1](https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1)
- [https://github.com/Tautulli/Tautulli/security/advisories/GHSA-v622-pmjj-gpx3](https://github.com/Tautulli/Tautulli/security/advisories/GHSA-v622-pmjj-gpx3)

## Related threats

- [Tautulli open redirect via whitespace bypass in /auth/redirect](https://junglewise.ai/threats/cve-2026-54915-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex)
- [Tautulli path traversal in file upload handlers](https://junglewise.ai/threats/cve-2026-52835-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex)
- [Tautulli stored XSS in newsletter cron field](https://junglewise.ai/threats/cve-2026-49995-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex)
- [Tautulli reflected XSS in search query](https://junglewise.ai/threats/cve-2026-45381-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex)
- [Tautulli unauthenticated SSRF in image route](https://junglewise.ai/threats/cve-2026-43986-tautulli-unauthenticated-ssrf-in-image-route)