dbcve.org
TautulliApplication

CVE-2026-28505

CRITICAL · 10.0 CVSS v3.1 Published 2026-03-30
Fix available
A fix is available. Upgrade to 2.17.0 or later.
See remediation →
100/100
Remediation priority · Urgent
Public exploit Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the str_eval() function in notification_handler.py implements a sandboxed eval() for notification text templates. The sandbox attempts to restrict callable names by inspecting code.co_names of the compiled code object. However, co_names only contains names from the outer code object. When a lambda expression is used, it creates a nested code object whose attribute accesses are stored in code.co_consts, NOT in code.co_names. The sandbox never inspects nested code objects. This issue has been patched in version 2.17.0.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Tautulli versions prior to 2.17.0 contain a sandbox bypass vulnerability in the str_eval() function in notification_handler.py. The function uses eval() with a sandbox that inspects code.co_names to block dangerous callables, but lambda expressions create nested code objects where attribute accesses are stored in code.co_consts instead of code.co_names. Since the sandbox never inspects nested code objects, attackers can bypass the restriction and achieve arbitrary code execution.

MitigationUpgrade Tautulli to version 2.17.0 or later. If immediate upgrade is not possible, disable notification text templates or restrict access to the notification configuration interface.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
TautulliApplication
Affected:< 2.17.0

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Locate your Tautulli installation directory
    Identify where Tautulli is installed on your system - common locations include /opt/tautulli, the directory where tautulli.py or Tautulli.exe resides, or your Plex Media Server plugins folder
    Affected if You cannot locate the installation directory or find the notification_handler.py file
  2. Determine installed Tautulli version
    Access the Tautulli web interface and navigate to Settings > About, or check the version file in your Tautulli directory, or run: python tautulli.py --version
    Affected if The version number is below 2.17.0
  3. Locate the notification_handler.py file
    In your Tautulli installation directory, find notification_handler.py (typically in the main Tautulli folder or under /py/)
    Affected if The file exists but you cannot verify it has been patched, or the file predates version 2.17.0
  4. Verify if str_eval function is present and uses eval()
    Open notification_handler.py and search for the str_eval function definition - confirm it uses eval() with a sandbox that inspects code.co_names
    Affected if The function exists and uses eval() with a co_names-based sandbox without checking nested code objects in co_consts
  5. Check if notification text templates are configured
    In Tautulli web UI, go to Settings > Notifications and review any configured notification agents that use text templates with dynamic evaluation
    Affected if Notification text templates are actively configured and in use, providing the attack surface for this vulnerability
  6. Review access to notification configuration
    Check who has access to the notification configuration settings - typically Settings > Notifications > Add Notification Agent
    Affected if Untrusted users or guests can access or modify notification settings

Your Tautulli installation is affected if you are running a version prior to 2.17.0, the notification_handler.py file contains the vulnerable str_eval() function with eval() and co_names sandbox, and notification text templates are configured or accessible to untrusted users.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 2.17.0 or later
Fixed in 2.17.0
Interim mitigation

Upgrade Tautulli to version 2.17.0 or later. If immediate upgrade is not possible, disable notification text templates or restrict access to the notification configuration interface.

Recommended fix High confidence

2.17.0

  1. 1. Backup your current Tautulli installation and configuration data.
  2. 2. Download Tautulli version 2.17.0 or later from the official GitHub repository.
  3. 3. Install the new version following the standard Tautulli installation process for your platform.
  4. 4. Verify the installation by checking the Tautulli web interface and confirming the version number displays 2.17.0 or higher.
  5. 5. Test that notification templates still function correctly after the upgrade.
Caveat Review Tautulli release notes for version 2.17.0 to confirm no breaking changes affect your notification templates or existing configurations.

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Tautulli Scoped from the published advisory
  • Consultation2.0 h
  • Implementation2.0 h
  • Testing2.0 h
  • Review / QA1.0 h
7.0 hours of engineering $1,240
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $1,984.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-28505 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-28505 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data