CVE-2026-28505: 
NixOS vulnerability analysis and mitigation

CVE-2026-28505 is a Remote Code Execution (RCE) vulnerability in Tautulli, a Python-based monitoring and tracking tool for Plex Media Server, caused by a sandbox escape in the str_eval() notification template evaluation function. It affects all Tautulli versions up to and including 2.16.1, and was patched in version 2.17.0 (released March 27–28, 2026). The vulnerability was discovered by researcher q1uf3ng and disclosed via GitHub Security Advisory on March 28, 2026 (GitHub Advisory). It carries a CVSS v3.1 base score of 10.0 (Critical) (Feedly).

The root cause is an incomplete sandbox implementation in plexpy/notification_handler.py (lines 1928–1944), classified as CWE-94 (Code Injection) and CWE-95 (Eval Injection). The str_eval() function compiles user-supplied notification template expressions and inspects code.co_names of the outer code object to enforce a callable name whitelist — but co_names only captures names from the outermost scope. When a lambda expression is used, it creates a nested code object whose attribute accesses (e.g., __globals__, popen, read) are stored in code.co_consts, which the sandbox never inspects. Because the allowed_names dict includes int (mapped to helpers.cast_to_int, a regular Python function), an attacker can use int.__globals__ to reach the plexpy.helpers module scope, which imports os, enabling arbitrary OS command execution via a payload such as {\(lambda f: f.globals["os"].popen("id").read())(int)`}` (GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary OS commands on the Tautulli server with the privileges of the Tautulli process, resulting in full compromise of confidentiality, integrity, and availability. An attacker can read sensitive files (including Plex tokens, API keys, and credentials), modify or delete data, and use the compromised host as a pivot point for lateral movement within the network. While the NOTIFY_TEXT_EVAL feature must be enabled (default: OFF), the advisory notes that the lack of CSRF protection on admin endpoints means a remote attacker could enable this setting and inject a malicious template without direct authentication (GitHub Advisory).

A concrete proof-of-concept exploit payload is publicly available in the GitHub Security Advisory, with step-by-step trigger instructions (GitHub Advisory). There is no confirmed evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.013% (very low probability of near-term exploitation), and the vulnerability is not currently listed in the CISA KEV catalog (Feedly). No threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing Tautulli instances running version ≤ 2.16.1 using Shodan, Censys, or similar tools searching for Tautulli's default port (8181).
2. Enable NOTIFY_TEXT_EVAL (if not already enabled): If the attacker has admin access (via stolen API key, credential reuse, or CSRF attack against an authenticated admin), navigate to Tautulli Advanced Settings and enable the NOTIFY_TEXT_EVAL option.
3. Configure malicious notification template: Create or edit a notification agent template to include the following backtick-delimited eval expression:

   {`(lambda f: f.__globals__["os"].popen("id").read())(int)`}

4. Trigger a notification event: Fire any Tautulli notification event (e.g., play, stop, recently added) that causes the malicious template to be evaluated by str_eval().
5. Achieve RCE: The lambda expression bypasses the co_names whitelist check, accesses int.__globals__ to reach the os module, and executes the arbitrary OS command on the server. Replace id with any desired command (e.g., a reverse shell payload) (GitHub Advisory).

• Logs: Tautulli application logs showing notification template evaluation containing lambda expressions, __globals__, popen, or os references; unexpected output in notification logs from OS command execution.
• Network: Outbound connections from the Tautulli server process to unknown external IPs (e.g., reverse shell callbacks); unusual DNS lookups originating from the Tautulli process.
• Process: Unexpected child processes spawned by the Tautulli Python process (e.g., /bin/sh, bash, curl, wget, python3) visible in process trees.
• File System: New or modified files in the Tautulli installation directory or temp directories; unexpected cron jobs or scheduled tasks created under the Tautulli service account.
• Configuration: NOTIFY_TEXT_EVAL setting enabled in Tautulli Advanced Settings when it was not intentionally configured; notification templates containing backtick-delimited expressions with lambda, __globals__, or os (GitHub Advisory).

Upgrade Tautulli to version 2.17.0 or later, which fixes the vulnerability by implementing recursive inspection of nested code objects (or AST-based validation) in the str_eval() sandbox (Tautulli Release). Note that v2.17.0 also patches several other critical vulnerabilities (CVE-2026-31831, CVE-2026-31799, CVE-2026-32275, CVE-2026-31804) and drops support for Python 3.9. If immediate patching is not possible, disable NOTIFY_TEXT_EVAL in Advanced Settings (it is OFF by default) and restrict network access to the Tautulli instance to trusted hosts only (GitHub Advisory).

The Tautulli maintainer (JonnyWong16) published the security advisory and credited researcher q1uf3ng for the discovery. The v2.17.0 release notes explicitly flag this as a critical security update and strongly encourage all users on versions ≤ 2.16.1 to upgrade immediately (Tautulli Release). No significant broader media coverage or notable external researcher commentary has been identified beyond the official advisory.