CVE-2026-31799

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 2.14.2 to before version 2.17.0 for parameters "before" and "after" and from version 2.1.0-beta to before version 2.17.0 for parameters "section_id" and "user_id", the /api/v2?cmd=get_home_stats endpoint passes the section_id, user_id, before, and after query parameters directly into SQL via Python %-string formatting without parameterization. An attacker who holds the Tautulli admin API key can inject arbitrary SQL and exfiltrate any value from the Tautulli SQLite database via boolean-blind inference. This issue has been patched in version 2.17.0.

• CWE-20
• CWE-89

• https://github.com/Tautulli/Tautulli/releases/tag/v2.17.0Release Notes
• https://github.com/Tautulli/Tautulli/security/advisories/GHSA-g47q-8j8w-m63qExploit, Mitigation, Vendor Advisory

Published

Mar 30, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-31793iccDEV provides a set of libraries and tools for working wit…5.5
• CVE-2026-31794iccDEV provides a set of libraries and tools for working wit…5.5
• CVE-2026-31795iccDEV provides a set of libraries and tools for working wit…7.8
• CVE-2026-31796iccDEV provides a set of libraries and tools for working wit…7.8
• CVE-2026-31797iccDEV provides a set of libraries and tools for working wit…6.1
• CVE-2026-31798JumpServer is an open source bastion host and an operation a…5
• CVE-2026-3180The Contest Gallery – Upload & Vote Photos, Media, Sell with…7.5
• CVE-2026-31800Parse Server is an open source backend that can be deployed …9.1
• CVE-2026-31801zot is ancontainer image/artifact registry based on the Open…7.7
• CVE-2026-31802node-tar is a full-featured Tar for Node.js. Prior to versio…5.5
• CVE-2026-31804Tautulli is a Python based monitoring and tracking tool for …5.3
• CVE-2026-31805Discourse is an open-source discussion platform. Prior to ve…8.2