CVE-2026-31799: 
NixOS vulnerability analysis and mitigation

CVE-2026-31799 is a SQL injection vulnerability in Tautulli, a Python-based monitoring and tracking tool for Plex Media Server. The /api/v2?cmd=get_home_stats endpoint passes the section_id, user_id, before, and after query parameters directly into SQL queries via Python %-string formatting without parameterization, enabling boolean-blind SQL injection. The section_id and user_id parameters are affected from version 2.1.0-beta onward, while before and after are affected from version 2.14.2 onward; all variants are fixed in version 2.17.0. It carries a CVSS v3.1 base score of 4.9 (Medium), reflecting the requirement for a valid admin API key (GitHub Advisory, Tautulli Release).

The root cause is improper input validation and SQL injection (CWE-20, CWE-89) in plexpy/datafactory.py, where integer parameters section_id and user_id are interpolated directly into SQL WHERE clauses using Python's % string formatting (e.g., 'AND session_history.section_id = %s ' % section_id), and string parameters before and after are similarly embedded inside single-quoted SQL string literals. Because section_id and user_id are substituted without surrounding quotes, no delimiter escaping is required to break out of a string literal context. An attacker with a valid admin API key can inject arbitrary SQL expressions — including boolean conditions — to perform boolean-blind inference, extracting database values character-by-character (approximately 100 requests per character). Write operations (INSERT/UPDATE/DELETE) are not directly reachable because SQLite's Python sqlite3 module rejects multi-statement execution (GitHub Advisory).

A successful exploit allows an attacker holding the Tautulli admin API key to exfiltrate any value from the Tautulli SQLite database via boolean-blind inference. Sensitive data at risk includes users.server_token (Plex Media Server API tokens), users.user_token (Plex.tv OAuth tokens), complete watch history (session_history.*), and login audit logs including IP addresses and user agents. While this does not constitute a privilege escalation beyond existing admin access, it enables stealthy exfiltration of Plex authentication tokens for all users in a manner that may be harder to detect than direct UI access (GitHub Advisory).

A proof-of-concept is publicly available in the GitHub Security Advisory, demonstrating the injection via curl commands that trigger SQL parse-time errors and boolean TRUE/FALSE conditions. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.016% (0.000160), reflecting low probability of near-term exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires possession of a valid Tautulli admin API key, which significantly limits the attacker pool (GitHub Advisory).

1. Obtain admin API key: Acquire the Tautulli admin API key through prior compromise of the Tautulli instance, credential theft, or insider access — this is a prerequisite for exploitation.
2. Verify injection point: Send a baseline request to confirm the endpoint is reachable and returns result=success:

   curl -s "http://TAUTULLI:8181/api/v2?cmd=get_home_stats&apikey=APIKEY&section_id=0"

3. Confirm SQL injection: Inject a syntactically invalid token to trigger a SQL parse-time error (expect result=error):

   curl -s "http://TAUTULLI:8181/api/v2?cmd=get_home_stats&apikey=APIKEY&section_id=0+SQLI_PROOF"

4. Test boolean conditions: Verify boolean-blind behavior — TRUE condition returns data, FALSE condition returns error:

   curl -s "http://TAUTULLI:8181/api/v2?cmd=get_home_stats&apikey=APIKEY&section_id=999999+OR+1=1"
   curl -s "http://TAUTULLI:8181/api/v2?cmd=get_home_stats&apikey=APIKEY&section_id=999999+OR+1=2"

5. Extract data via boolean-blind inference: Craft SQL subqueries using SUBSTR() and UNICODE() functions to extract target values (e.g., users.server_token) character-by-character, using the TRUE/FALSE response differential to infer each character (~100 requests per character).
6. Exfiltrate Plex tokens: Collect extracted server_token and user_token values to gain access to Plex Media Server APIs and Plex.tv OAuth sessions for all users (GitHub Advisory).

• Network: High volume of HTTP GET requests to /api/v2?cmd=get_home_stats with unusual or encoded section_id, user_id, before, or after parameter values; repeated requests with incrementally varying parameters (indicative of character-by-character extraction); requests containing SQL keywords such as OR, AND, SUBSTR, UNICODE, or arithmetic operators in query parameters.
• Logs: Tautulli access logs showing result=error responses interleaved with result=success responses for the get_home_stats command from the same source IP; log entries with URL-encoded SQL syntax (+OR+, +AND+, SQLI_PROOF) in query strings.
• Behavioral: Sudden spike in API requests from a single IP or API key targeting only the get_home_stats endpoint; API key usage at unusual hours or from unexpected IP addresses (GitHub Advisory).

Upgrade Tautulli to version 2.17.0 or later, which replaces Python %-string formatting with SQLite parameterized queries (? placeholders) for all affected parameters in plexpy/datafactory.py. No official workaround exists for unpatched versions beyond restricting network access to the Tautulli API endpoint. Additionally, rotate any potentially exposed API keys, Plex server tokens, and Plex.tv OAuth tokens, and restrict Tautulli API access to trusted networks or authenticated users only (Tautulli Release, GitHub Advisory).

The vulnerability was discovered and reported by security researcher mandreko, who is credited in both the GitHub Security Advisory and the v2.17.0 release notes. The Tautulli maintainer (JonnyWong16) published the advisory and patched the issue promptly, noting in the release that "several security vulnerabilities have been identified in Tautulli versions <=2.16.1" and strongly encouraging users to update. No significant broader media coverage or social media discussion has been identified beyond the official advisory (GitHub Advisory, Tautulli Release).