CVE-2026-45381 Tautulli CVE debrief

Who should care

Defenders responsible for Tautulli instances, particularly those with exposed web interfaces, should assess exposure and prioritize patching to prevent potential script execution. This includes reviewing compensating controls for exposed systems, monitoring for suspicious activity, and restricting access to the Tautulli web interface. Additionally, defenders should track exceptions, retest remediated assets, and close the item only after evidence is

Why it matters

CVE-2026-45381 is a medium-severity vulnerability in Tautulli that allows unauthenticated attackers to execute script in the Tautulli web context. Defenders should prioritize verifying and applying the patch to prevent potential script execution and unauthorized actions.

• Potential script execution in the Tautulli web context
• Possible unauthorized actions on Tautulli instances
• Required verification of patch application
• Need for monitoring and restricting access to Tautulli instances

Technical summary

The /search endpoint in Tautulli inserts user-controlled query parameters into a JavaScript string without proper escaping, allowing an unauthenticated attacker to execute script in the Tautulli web context when an authenticated user follows a crafted link. This issue is caused by manual escaping that handles quotes and slashes but not backslashes, making it possible for an attacker to terminate the string with a backslash-quote sequence. Defenders should prioritize verifying and applying the patch to prevent potential script execution.

Defensive priority

Defenders should prioritize verifying and applying the patch to prevent potential script execution.

Recommended defensive actions

• Verify and apply the patch to Tautulli version 2.17.2
• Monitor for suspicious activity on Tautulli instances
• Restrict access to the Tautulli web interface
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability has been fixed in version 2.17.2. Defenders should verify patch application and monitor for suspicious activity on Tautulli instances. The CVE record was published on 2026-09-21T20:17:25.263Z and has not been modified since then. There are no known ransomware campaign uses. The vendor has provided guidance on patching and mitigation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.