CVE-2026-41065

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 are vulnerable to remote code execution via the newsletter custom template directory feature. On a fresh install before the setup wizard is completed, all management endpoints are completely unauthenticated. An attacker can create a newsletter agent, point the custom template directory to an attacker-controlled SMB share serving a malicious Mako template, and trigger execution via the newsletter render endpoint, all with zero credentials and no local access to the target system. On a completed install with credentials configured, the same chain is exploitable by any admin. Version 2.17.1 fixes the issue.

• CWE-1336

• https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1
• https://github.com/Tautulli/Tautulli/security/advisories/GHSA-68qx-mcf5-3jcp
• https://github.com/Tautulli/Tautulli/security/advisories/GHSA-68qx-mcf5-3jcp

Published

Jun 4, 2026

Last Modified

Jul 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4106The HT Mega Addons for Elementor WordPress plugin before 3.…5.3
• CVE-2026-41060WWBN AVideo is an open source video platform. In versions 29…6.5
• CVE-2026-41061WWBN AVideo is an open source video platform. In versions 29…5.4
• CVE-2026-41062WWBN AVideo is an open source video platform. In versions 29…6.5
• CVE-2026-41063WWBN AVideo is an open source video platform. In versions 29…5.4
• CVE-2026-41064WWBN AVideo is an open source video platform. In versions up…9.3
• CVE-2026-41066lxml is a library for processing XML and HTML in the Python …7.5
• CVE-2026-41067Astro is a web framework. Prior to 6.1.6, the defineScriptVa…6.1
• CVE-2026-41068Kyverno is a policy engine designed for cloud native platfor…7.7
• CVE-2026-41069libheif is a HEIF and AVIF file format decoder and encoder. …6.5
• CVE-2026-4107Zohocorp ManageEngine Exchange Reporter Plus versions before…5.4
• CVE-2026-41070openvpn-auth-oauth2 is a plugin/management interface client …10