# CVE-2026-43986: Tautulli unauthenticated SSRF in image route

Source: https://junglewise.ai/threats/cve-2026-43986-tautulli-unauthenticated-ssrf-in-image-route  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-04. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

CVE-2026-43986 · Severity: critical · CVSS 9.9 · Published 2026-06-04

Tautulli, a monitoring tool for Plex Media Servers, contains a vulnerability that allows attackers to perform unauthorized network requests from the server. By exploiting a flaw in how images are cached and retrieved, a low-privileged guest user can force the server to connect to arbitrary internal or external web addresses. This can lead to the exposure of sensitive internal data or be used to launch further attacks against the local network, even by users who are not logged in once the initial setup is performed.

Technologies: [Tautulli](https://junglewise.ai/threats/technologies/tautulli). Vendors: [Tautulli](https://junglewise.ai/threats/vendors/tautulli).

## Quick answers

**Is CVE-2026-43986 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43986 being exploited in the wild.

**How severe is CVE-2026-43986?** Critical severity, with a CVSS score of 9.9, published 4 June 2026.

**Which products and versions are affected?** Tautulli < 2.17.1.

**Is there a fix for CVE-2026-43986?** A patch was published on 2026-05-04: Version 2.17.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-43986 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-43986?** Check whether you run Tautulli at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Tautulli exposes a public `/image/<hash>` route that resolves entries from the `image_hash_lookup` table and replays them through server-side image fetch logic. A low-privilege guest user can seed a malicious URL into this table via the authenticated `/pms_image_proxy` endpoint. Because the hash generation is deterministic and uses values disclosed during sign-in (such as the PMS UUID), an attacker can calculate the hash offline. Once seeded, any unauthenticated user can request the specific `/image/<hash>` URL, causing the Tautulli host to fetch the attacker-chosen URL using the administrator's PMS token. This vulnerability effectively upgrades an authenticated SSRF primitive into a persistent, unauthenticated SSRF gadget. The issue is patched in version 2.17.1.

## Affected products

- Tautulli Tautulli < 2.17.1

## Timeline

- 2026-05-04: patched: Version 2.17.1 released
- 2026-05-27: advisory: GitHub Security Advisory published
- 2026-06-04: disclosed: CVE published to NVD

## References

- [https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1](https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1)
- [https://github.com/Tautulli/Tautulli/security/advisories/GHSA-m6j6-rc2c-8vpm](https://github.com/Tautulli/Tautulli/security/advisories/GHSA-m6j6-rc2c-8vpm)

## Related threats

- [Tautulli open redirect via whitespace bypass in /auth/redirect](https://junglewise.ai/threats/cve-2026-54915-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex)
- [Tautulli path traversal in file upload handlers](https://junglewise.ai/threats/cve-2026-52835-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex)
- [Tautulli stored XSS in newsletter cron field](https://junglewise.ai/threats/cve-2026-49995-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex)
- [Tautulli reflected XSS in search query](https://junglewise.ai/threats/cve-2026-45381-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex)
- [Tautulli CSRF in configUpdate allows administrator takeover](https://junglewise.ai/threats/cve-2026-43985-tautulli-csrf-in-configupdate-allows-administrator-takeover)