TACTICAL RMM · CVE-2026-129165 · Other
NO FIX YET
Tactical RMM versions 0.17.0 through 1.6.1 resolve file:// links in user-supplied report templates and embed the files in a returned PDF. A user with report management permission can read the Django SECRET_KEY, which is reused as the NATS password, and then send runscript commands to every managed agent.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted Tactical RMM servers running 0.17.0 through 1.6.1 (1.6.1 is the latest release listed on GitHub). Exposed when an account holds report management permission: it can POST a template to /reporting/templates/preview/ and get server files back in a PDF. The researcher reports the Django SECRET_KEY (in local_settings.py) is reused as the NATS password, which would let the attacker send commands to every managed agent. Installs with no untrusted users holding report permission carry less risk, but the permission gives access to the whole fleet.
Not affected if version-outside-range
Who cares authenticated, django, nats, rmm, self-hosted, tactical-rmm
No fix yet, per the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
Tactical RMM 0.17.0 through 1.6.1 contains an arbitrary file read in the /reporting/templates/preview/ endpoint because WeasyPrint resolves file:// links in user-supplied template_md and embeds the files in the returned PDF. Users with report management permission can read the Django SECRET_KEY, reused as the NATS password, and publish runscript commands to every managed agent.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.