CVE-2026-28505: RCE in Tautulli Plex Media Server Monitor

The impact of CVE-2026-28505 is significant, as it allows for complete remote code execution. An attacker who can inject a malicious notification template can gain control of the server running Tautulli. This could lead to data theft (Plex library information, user credentials), system compromise, and potentially lateral movement within the network if the Tautulli server has access to other resources. The vulnerability's reliance on notification templates means that users who customize these templates are particularly at risk. The nested code object flaw, where lambda expressions bypass the sandbox's name inspection, is a critical factor in enabling this exploitation.

1. Reserved2026-02-27
2. Published2026-03-30
3. EPSS updated2026-04-07

The primary mitigation for CVE-2026-28505 is to immediately upgrade Tautulli to version 2.17.0 or later. If upgrading is not immediately feasible due to compatibility issues or system downtime constraints, consider disabling custom notification templates as a temporary workaround. This will prevent the injection of malicious templates. Monitor Tautulli logs for any unusual activity, particularly related to notification processing. While a WAF or proxy cannot directly prevent this vulnerability, it can be configured to monitor for suspicious template content. After upgrading, confirm the fix by attempting to trigger a notification with a complex template and verifying that it does not result in code execution.