CVE-2026-43986

Tautulli (Python-based tool for Plex) prior to v2.17.1 exposes a public /image/ endpoint that uses image_hash_lookup to replay server-side image fetch logic. A low-privilege guest can seed a malicious external image URL and trigger SSRF via an unauthenticated endpoint, turning an authenticated SS...