CVE-2026-31804: Tautulli SSRF Vulnerability

CVE-2026-31804 Overview

CVE-2026-31804 is a Server-Side Request Forgery (SSRF) vulnerability affecting Tautulli, a Python-based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /pms_image_proxy endpoint accepts a user-supplied img parameter and forwards it to Plex Media Server's /photo/:/transcode transcoder without authentication and without restricting the scheme or host. This allows attackers to force the Plex Media Server process to make outbound HTTP requests to attacker-controlled URLs, potentially exposing internal network resources.

Critical Impact
Unauthenticated attackers can leverage this SSRF vulnerability to probe internal network services (RFC-1918 address space), potentially accessing sensitive internal resources or conducting further attacks against systems within the same network as Tautulli.

Affected Products

Tautulli versions prior to 2.17.0
Plex Media Server deployments monitored by vulnerable Tautulli instances
Internal network services accessible from the Plex Media Server host

Discovery Timeline

2026-03-30 - CVE-2026-31804 published to NVD
2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-31804

Vulnerability Analysis

This vulnerability is classified as CWE-918 (Server-Side Request Forgery). The /pms_image_proxy endpoint in Tautulli is intentionally excluded from all authentication checks in webstart.py, meaning any unauthenticated user can access this endpoint. The endpoint accepts an img parameter intended for image proxying, but any value beginning with http is passed directly to the Plex Media Server without validation of the scheme or target host.

The Plex Media Server process typically runs on the same host or within the internal network as Tautulli, with full access to RFC-1918 private address space. This means an attacker can instruct the server to make HTTP requests to arbitrary internal endpoints, potentially exposing internal services, metadata endpoints, or other sensitive network resources that would otherwise be inaccessible from external networks.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and the absence of URL scheme/host restrictions on the img parameter within the /pms_image_proxy endpoint. The endpoint was explicitly excluded from authentication requirements, and no safeguards were implemented to prevent requests to arbitrary hosts or internal network addresses.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker can craft a malicious request to the /pms_image_proxy endpoint with a specially crafted img parameter pointing to internal network resources. When the Tautulli application processes this request, it instructs the Plex Media Server to fetch the attacker-specified URL, effectively allowing the attacker to:

Scan internal network services and enumerate open ports
Access cloud provider metadata endpoints (e.g., AWS IMDSv1)
Retrieve sensitive data from internal APIs or services
Potentially pivot to other attacks based on discovered internal resources

The exploitation mechanism involves sending HTTP requests to the vulnerable endpoint with the img parameter set to internal URLs (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata or http://192.168.1.1/admin for internal services).

Detection Methods for CVE-2026-31804

Indicators of Compromise

Unusual outbound HTTP requests from the Plex Media Server process to internal IP addresses or cloud metadata endpoints
Access logs showing requests to /pms_image_proxy with suspicious img parameter values containing internal IP addresses or non-standard hostnames
Network connections from the Plex Media Server to RFC-1918 addresses that are not part of normal media streaming operations

Detection Strategies

Monitor web server access logs for requests to the /pms_image_proxy endpoint containing img parameters with internal IP addresses (10.x.x.x, 172.16.x.x-172.31.x.x, 192.168.x.x) or cloud metadata endpoints
Implement network monitoring rules to detect outbound HTTP connections from Plex Media Server to internal services that are not part of its normal operation
Deploy web application firewall (WAF) rules to flag or block requests to /pms_image_proxy with potentially malicious URL patterns

Monitoring Recommendations

Enable detailed access logging for the Tautulli web application and review logs for anomalous /pms_image_proxy requests
Set up alerts for outbound connections from media server processes to internal network ranges or cloud metadata services
Implement egress filtering to restrict which hosts the Plex Media Server process can communicate with

How to Mitigate CVE-2026-31804

Immediate Actions Required

Upgrade Tautulli to version 2.17.0 or later immediately
Review access logs for evidence of exploitation attempts targeting the /pms_image_proxy endpoint
Implement network segmentation to limit internal network access from media server hosts
Deploy a reverse proxy or WAF with rules to filter malicious requests

Patch Information

This vulnerability has been patched in Tautulli version 2.17.0. The patch restricts the URL schemes and hosts that can be specified in the img parameter, preventing SSRF attacks. Organizations should upgrade to this version or later as soon as possible. For detailed patch information, see the Tautulli Release v2.17.0 and the GitHub Security Advisory GHSA-qj2f-4c4p-wv97.

Workarounds

Implement a reverse proxy in front of Tautulli that blocks or sanitizes requests to /pms_image_proxy with external or internal IP addresses in the img parameter
Restrict network access to Tautulli to trusted networks only until patching is complete
Deploy egress firewall rules to prevent the Plex Media Server process from making HTTP connections to internal network ranges or cloud metadata endpoints

bash

# Example nginx configuration to block suspicious img parameters
location /pms_image_proxy {
    # Block requests with internal IP addresses in img parameter
    if ($arg_img ~* "^https?://(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.)") {
        return 403;
    }
    proxy_pass http://localhost:8181;
}