CVE-2026-31804 Tautulli: Unauthenticated pms_image_proxy endpoint proxies arbitrary HTTP requests through the Plex Media Server
Unauthenticated attackers can force Tautulli to proxy arbitrary HTTP requests via Plex Media Server, enabling access to internal network resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-31804?
CVE-2026-31804 is a medium-severity server-side request forgery vulnerability in Tautulli, published on 30 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /pms_image_proxy endpoint accepts a user-supplied img parameter and forwards it to Plex Media Server's /photo/:/ transcode transcoder without authentication and without restricting the scheme or host. The endpoint is intentionally excluded from all authentication checks in webstart.py, any value of img beginning with http is passed directly to Plex, this causes the Plex Media Server process, which typically runs on the same host or internal network as Tautulli, with access to RFC-1918 address space, to issue an outbound HTTP request to any attacker-specified URL. This issue has been patched in version 2.17.0.
Weakness: CWE-918
Which versions are affected by CVE-2026-31804?
It affects 1 product.
Products include Tautulli Tautulli.
How do I fix CVE-2026-31804?
No fix has been published for CVE-2026-31804 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-31804 being exploited?
There is no known exploitation of CVE-2026-31804 in the wild and no public exploit code.
Other vulnerabilities in Tautulli
- CVE-2025-58762 Tautulli vulnerable to Authenticated Remote Code Execution via write primitive and `Script` notification agent
- CVE-2026-31831 Tautulli: Unauthenticated Path Traversal in `/newsletter/image/images` endpoint
- CVE-2025-58760 Tautulli vulnerable to Unauthenticated Path Traversal in `/image` endpoint
- CVE-2025-58761 Tautulli vulnerable to Unauthenticated Path Traversal in `real_pms_image_proxy`
- CVE-2025-58763 Tautulli vulnerable to Authenticated Remote Code Execution via Command Injection
Sources
Also known as GHSA-qj2f-4c4p-wv97.