CVE-2026-28505 is a maximum severity (CVSS 10.0) code injection flaw in Tautulli, the Python monitoring tool for Plex Media Server, in versions before 2.17.0. The sandbox around notification text templates can be escaped. Upgrade to 2.17.0 or later, and limit who can reach the app.
What's affected
The NVD record says Tautulli versions before 2.17.0 are affected and that 2.17.0 is the patched release. The GitHub advisory text lists 2.16.1 and earlier as affected, with 2.16.2 as patched. The two sources differ, so the safe move is to run 2.17.0 or later.
The flaw is in the str_eval() function in notification_handler.py, which evaluates notification text templates.
How to check if you're exposed
If you installed with pip or from source, check the version in the web UI (Settings, then About) or from the install directory:
git -C /path/to/Tautulli describe --tags
For Docker, check the image tag you run with docker ps and compare it with the 2.17.0 release. Anything older needs to be upgraded.
Also find out who can log in to Tautulli and edit notification agents, since that is the route the advisory describes.
What to do now
- Upgrade Tautulli to 2.17.0 or later and restart it.
- Do not expose Tautulli directly to the internet. Put it behind a VPN or an authenticating reverse proxy.
- Review who holds an account and who can edit notification templates, and remove access that is not needed.
- Check the host for unexpected processes, scheduled tasks or new files if the app was reachable from outside while on an old version.
- Rotate any API keys or tokens stored in Tautulli's settings if you suspect misuse.
Why it matters
The weakness is code injection, CWE-94, in the specific form CWE-95: evaluation of dynamically built code. The app tried to make eval() safe by checking the names used in the compiled expression against an allowlist.
The check only looked at the outer code object. Nested code objects, which a lambda expression creates, store their names in a different place, so they were never inspected. The advisory describes this as a sandbox bypass. Filtering names is a fragile way to contain code that you evaluate on a user's behalf, and this bug is a good example of why.
Scope in the CVSS vector is changed and impact on confidentiality, integrity and availability is high, which is how the score reaches 10.0. The record does not mark this CVE as exploited in the wild, but with a score this high on a self-hosted web app, patching should not wait.
The broader lesson is to treat any feature that evaluates text from a settings page as a code execution feature, and to restrict it as such.
Quick check
Do I need to be logged in to be at risk?
The CVSS vector in the record lists no privileges required. Even so, the advisory describes the problem as happening through notification templates, so lock down both network access and who can edit them.
Sources
Last reviewed: 19 October 2026.
