The vulnerability exists in Tautulli prior to version 2.17.1 in the publicly reachable /image/<hash> endpoint. An attacker can insert a malicious image URL into the image_hash_lookup table, causing the server to fetch that URL during image generation. Because this endpoint does not require authentication, any external user can trigger retransmission of the stored hash, leading to a persistent unauthenticated Server Side Request Forgery that can reach arbitrary internal or external addresses. This allows attackers to exfiltrate data, discover network services, or potentially execute further attacks.

All installations of Tautulli using versions older than 2.17.1 are affected. The issue is present in the Tautulli monitoring tool for Plex Media Server, which runs on Python. Users should verify their installed version and upgrade if necessary.

The CVSS score is 9.9, indicating a critical level of risk. The EPSS score is not available, but the absence of a KEV listing does not diminish the severity; the vulnerability can be exploited by anyone who can access a Tautulli instance, making it highly likely to be abused on exposed servers. The attack path requires only an unauthenticated HTTP request to /image/<hash>, and the attacker must first seed the malicious hash via a low‑privilege guest account, which is relatively easy. Once seeded, any external user can trigger the SSRF whenever they request the image, creating a persistent gadget that can be used without further credentials.