Summaryinfo

A vulnerability classified as critical was found in Tautulli up to 2.16.x. Affected by this issue is the function str_eval of the file notification_handler.py. Executing a manipulation can lead to code injection. This vulnerability is handled as CVE-2026-28505. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Tautulli up to 2.16.x. It has been declared as problematic. This vulnerability affects the function str_eval of the file notification_handler.py. The manipulation with an unknown input leads to a code injection vulnerability. The CWE definition for the vulnerability is CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the str_eval() function in notification_handler.py implements a sandboxed eval() for notification text templates. The sandbox attempts to restrict callable names by inspecting code.co_names of the compiled code object. However, co_names only contains names from the outer code object. When a lambda expression is used, it creates a nested code object whose attribute accesses are stored in code.co_consts, NOT in code.co_names. The sandbox never inspects nested code objects. This issue has been patched in version 2.17.0.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-28505 since 02/27/2026. The exploitation appears to be difficult. The attack can be initiated remotely. The exploitation needs additional levels of successful authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.

Upgrading to version 2.17.0 eliminates this vulnerability. The upgrade is hosted for download at github.com.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Tautulli

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16

Website

• Product: https://github.com/Tautulli/Tautulli/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion