Tautulli: eval() सैंडबॉक्स बाईपास के माध्यम से RCE, लैम्ब्डा नेस्टेड स्कोप का उपयोग करके co_names व्हाइटलिस्ट चेक से बचने के लिए

The impact of CVE-2026-28505 is significant, as it allows for complete remote code execution. An attacker who can inject a malicious notification template can gain control of the server running Tautulli. This could lead to data theft (Plex library information, user credentials), system compromise, and potentially lateral movement within the network if the Tautulli server has access to other resources. The vulnerability's reliance on notification templates means that users who customize these templates are particularly at risk. The nested code object flaw, where lambda expressions bypass the sandbox's name inspection, is a critical factor in enabling this exploitation.

Users who have customized Tautulli's notification templates are at the highest risk. This includes users who have modified templates to include custom formatting, dynamic content, or external data sources. Shared hosting environments where multiple users share the same Tautulli instance are also at increased risk, as a compromised user's template could affect other users.

• python / server:

import os
import subprocess

def check_tautulli_version():
    try:
        result = subprocess.check_output(['python3', '-c', 'import tautulli; print(tautulli.__version__)'], stderr=subprocess.STDOUT)
        version = result.decode('utf-8').strip()
        if version <= '2.17.0':
            print(f"Tautulli version is vulnerable: {version}")
        else:
            print(f"Tautulli version is patched: {version}")
    except FileNotFoundError:
        print("Tautulli not found.")
    except Exception as e:
        print(f"Error checking version: {e}")

check_tautulli_version()

• generic web:

curl -I http://your-tautulli-server/ | grep Server

• generic web: Inspect Tautulli's notification template files for suspicious code or unusual function calls.

1. 2026-03-30Disclosure

   disclosure

1. आरक्षित2026-02-27
2. प्रकाशित2026-03-30
3. EPSS अद्यतन2026-04-07

The primary mitigation for CVE-2026-28505 is to immediately upgrade Tautulli to version 2.17.0 or later. If upgrading is not immediately feasible due to compatibility issues or system downtime constraints, consider disabling custom notification templates as a temporary workaround. This will prevent the injection of malicious templates. Monitor Tautulli logs for any unusual activity, particularly related to notification processing. While a WAF or proxy cannot directly prevent this vulnerability, it can be configured to monitor for suspicious template content. After upgrading, confirm the fix by attempting to trigger a notification with a complex template and verifying that it does not result in code execution.