CVE-2026-28505: Tautulli RCE Vulnerability

CVE-2026-28505 Overview

CVE-2026-28505 is a Code Injection vulnerability affecting Tautulli, a Python-based monitoring and tracking tool for Plex Media Server. The vulnerability exists in the str_eval() function within notification_handler.py, which implements a sandboxed eval() for notification text templates. Due to a flaw in how the sandbox inspects code objects, attackers with high privileges can bypass sandbox restrictions using lambda expressions to execute arbitrary code.

Critical Impact

Authenticated attackers with administrative privileges can bypass the notification template sandbox and achieve remote code execution on the Tautulli server, potentially compromising the underlying system and connected Plex Media Server infrastructure.

Affected Products

• Tautulli versions prior to 2.17.0
• Tautulli notification template processing functionality
• Systems running Tautulli with notification features enabled

Discovery Timeline

• 2026-03-30 - CVE-2026-28505 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-28505

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code - Code Injection). The flaw resides in Tautulli's notification template processing system, specifically within the str_eval() function in notification_handler.py. This function is designed to provide a sandboxed environment for evaluating user-provided notification templates safely.

The sandbox implementation attempts to restrict callable names by inspecting the code.co_names attribute of compiled code objects. This approach was intended to prevent users from accessing dangerous built-in functions or modules that could be used for malicious purposes. However, the implementation contains a critical oversight in how Python code objects are structured.

Root Cause

The root cause of this vulnerability lies in the incomplete inspection of nested code objects. When Python code is compiled, the co_names attribute only contains names from the outer code object. Lambda expressions, anonymous functions defined inline, create nested code objects whose attribute accesses are stored in code.co_consts rather than code.co_names.

The sandbox implementation fails to recursively inspect nested code objects. This means that while the outer template may appear safe when its co_names are examined, a lambda expression embedded within it can contain arbitrary attribute accesses and function calls that completely bypass the sandbox's security checks.

Attack Vector

The attack vector is network-based, requiring an authenticated attacker with high privileges (typically administrator access to the Tautulli web interface). An attacker can craft a malicious notification template containing a lambda expression that, when evaluated by the str_eval() function, escapes the sandbox restrictions.

By embedding dangerous code within a lambda expression, the attacker can access Python's built-in functions, import modules, and ultimately execute arbitrary system commands on the server hosting Tautulli. This could lead to complete system compromise, data exfiltration, or lateral movement within the network.

The vulnerability is exploited through the notification template system, where user-controlled input is processed by the vulnerable str_eval() function. The attacker leverages the fact that nested code objects (created by lambda expressions) are not subject to the same security checks as the parent code object.

Detection Methods for CVE-2026-28505

Indicators of Compromise

• Unusual notification templates containing lambda expressions or nested function definitions
• Unexpected system processes spawned by the Tautulli application
• Modifications to notification templates by unauthorized or suspicious accounts
• Anomalous network connections originating from the Tautulli server

Detection Strategies

• Monitor Tautulli configuration files for suspicious notification template modifications
• Implement file integrity monitoring on notification_handler.py and related configuration files
• Review Tautulli access logs for administrative actions related to notification template changes
• Deploy application-level logging to capture str_eval() function calls and their parameters

Monitoring Recommendations

• Enable verbose logging in Tautulli to capture all template evaluation activities
• Configure SIEM alerts for process execution anomalies from the Tautulli application directory
• Monitor for unusual Python subprocess activity on systems running Tautulli
• Implement network segmentation to limit the blast radius of potential exploitation

How to Mitigate CVE-2026-28505

Immediate Actions Required

• Upgrade Tautulli to version 2.17.0 or later immediately
• Audit all existing notification templates for suspicious lambda expressions or nested functions
• Review administrative access logs to identify any potentially malicious template modifications
• Consider temporarily disabling custom notification templates until the patch is applied

Patch Information

The Tautulli development team has addressed this vulnerability in version 2.17.0. The patch fixes the sandbox bypass by properly inspecting nested code objects, including those created by lambda expressions. Users should upgrade to this version or later to remediate the vulnerability.

For detailed patch information, refer to the Tautulli Release v2.17.0 and the GitHub Security Advisory GHSA-m62j-gwm9-7p8m.

Workarounds

• Restrict administrative access to Tautulli to only trusted users until the patch can be applied
• Disable or remove custom notification templates that are not essential
• Implement network-level controls to limit access to the Tautulli web interface
• Consider running Tautulli in a containerized or isolated environment to limit potential impact

# Upgrade Tautulli to patched version
cd /path/to/tautulli
git fetch --all
git checkout v2.17.0
pip install -r requirements.txt
# Restart Tautulli service
systemctl restart tautulli