CVE-2026-31804: 
NixOS vulnerability analysis and mitigation

CVE-2026-31804 is a Server-Side Request Forgery (SSRF) vulnerability in Tautulli, a Python-based monitoring and tracking tool for Plex Media Server. The /pms_image_proxy endpoint accepts a user-supplied img parameter and forwards it to Plex Media Server's /photo/:/transcode transcoder without authentication or host/scheme restrictions, allowing unauthenticated attackers to force the Plex process to issue arbitrary outbound HTTP requests. All Tautulli versions prior to 2.17.0 (specifically confirmed in version 2.16.1) are affected. The vulnerability was published on March 30, 2026, and patched in version 2.17.0 released March 28, 2026. It carries a CVSS v3.1 base score of 4.0 (Moderate) per the GitHub advisory, or 5.3 (Medium) per NVD (GitHub Advisory, Feedly).

The root cause is CWE-918 (Server-Side Request Forgery), stemming from two design flaws: the /pms_image_proxy endpoint is explicitly excluded from all authentication checks in webstart.py, and in pmsconnect.py, any img parameter value beginning with http is passed directly to Plex as a URL parameter without scheme or host validation. The vulnerable code constructs a request to /photo/:/transcode?url=<attacker-controlled-url> and forwards it to the Plex Media Server process, which typically runs on the same host or internal network with access to RFC-1918 address space. The SSRF is blind — http_handler.py only returns a response body on HTTP 200/201 from Plex, so non-image responses from internal hosts are not echoed to the attacker, which is why attack complexity is rated High. Exploitation requires no authentication and no user interaction (GitHub Advisory).

An unauthenticated remote attacker can exploit this vulnerability to cause the Plex Media Server process to make arbitrary HTTP requests to attacker-specified URLs, enabling internal network reconnaissance. Demonstrated impacts include leakage of the Plex Media Server version string via the User-Agent header in outbound requests, enumeration of open TCP ports on internal hosts through timing differences, and discovery of internal services accessible within the RFC-1918 network segment reachable by the Plex host. This could facilitate lateral movement within internal networks, though confidentiality impact is limited (Low) and there is no integrity or availability impact (GitHub Advisory, Feedly).

No active in-the-wild exploitation has been observed. A conceptual proof-of-concept (a simple curl command) is included in the GitHub security advisory, but no weaponized exploit code is publicly available. The EPSS score is approximately 0.045% (0.000450), indicating low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. The vulnerability was reported by researcher "mandreko" (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing or network-accessible Tautulli instances (default port 8181) running versions prior to 2.17.0 using tools like Shodan, Censys, or network scanning.
2. Identify the vulnerable endpoint: Confirm the /pms_image_proxy endpoint is accessible without authentication — it is explicitly excluded from auth checks in all pre-2.17.0 versions.
3. Craft the SSRF request: Send an unauthenticated HTTP GET request with an attacker-controlled URL as the img parameter, e.g.:

   curl 'http://TAUTULLI:8181/pms_image_proxy?img=http://192.168.1.1/'

4. Trigger internal request: Tautulli forwards the img value to Plex's /photo/:/transcode?url=http://192.168.1.1/, causing the Plex process to issue an outbound HTTP request to the specified internal host.
5. Out-of-band interaction: Use an OOB interaction server (e.g., Interactsh, Burp Collaborator) as the target URL to confirm the request is made and capture the Plex User-Agent header revealing the Plex version.
6. Internal port scanning: Probe RFC-1918 addresses and ports via repeated requests, using timing differences (open ports respond faster than filtered ones) to enumerate internal services accessible to the Plex host (GitHub Advisory).

• Network: Outbound HTTP requests from the Plex Media Server host to unexpected internal RFC-1918 addresses or external OOB interaction servers; unusual HTTP traffic on port 8181 (Tautulli) with img parameters containing http:// URLs pointing to internal hosts.
• Logs: Tautulli server logs containing entries such as Failed to get image http://<internal-ip>/, falling back to None; repeated requests to /pms_image_proxy with varying img parameter values from a single source IP.
• Network: Plex Media Server User-Agent string appearing in HTTP requests to unexpected external or internal destinations, revealing version information to potential attackers.
• Process: Plex Media Server process initiating outbound TCP connections to RFC-1918 addresses or unusual external hosts not associated with normal Plex cloud services (GitHub Advisory).

Upgrade Tautulli to version 2.17.0 or later, which adds authentication to the /pms_image_proxy endpoint and restricts the img parameter to valid internal Plex library paths. As a temporary workaround prior to patching, implement network-level firewall rules to restrict outbound HTTP requests from the Plex Media Server process to only necessary destinations, and consider blocking unauthenticated external access to the Tautulli web interface (port 8181). If a web image proxy is genuinely required, enforce a strict allowlist of permitted origins at the application or network level (GitHub Advisory, Tautulli v2.17.0 Release).

The vulnerability was discovered and reported by researcher "mandreko," who also reported several other vulnerabilities fixed in the same Tautulli v2.17.0 release (including SQL injection CVE-2026-31799 and unsanitized JSONP callback CVE-2026-32275). The Tautulli maintainer JonnyWong16 published the advisory and patch promptly. The v2.17.0 release notes explicitly flag multiple security vulnerabilities and strongly encourage all users on versions ≤2.16.1 to update immediately (Tautulli v2.17.0 Release, GitHub Advisory).