Plex Media Server SSRF Vulnerability Advisory (CVE-2026-96652) - Internal Network Pivoting and Request Forgery

Affected Vendors

Plex

Affected Components

Plex Media Server

Published Date

2026-09-23

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

All Plex Media Server installations prior to version 1.43.3.10861.

Impact

Authenticated attackers with a valid X-Plex-Token can force the server to perform unauthorized HTTP POST requests to arbitrary internal or external destinations.

Mitigation

Immediately update Plex Media Server to version 1.43.3.10861 or later.

Affected Products & Version Scope

All versions of Plex Media Server before 1.43.3.10861 are vulnerable. Systems exposed to the public internet or those with shared user access are at significantly higher risk.

Remediation & Live Workaround Commands

PATCH & WORKAROUND

The primary remediation is to upgrade to the patched version.

Update Server:
For Windows/macOS: Use the built-in update check in the Plex Web UI.
For Linux: Update via the official repository or download the latest .deb/.rpm package.

Network Hardening:

Restrict access to the Plex management port (default 32400) to trusted IP ranges only. If using a reverse proxy, implement a rule to block URL patterns in the 'protocol' query string:

nginx

   location /player/timeline {
       if ($arg_protocol ~ "^http") {
           return 403;
       }
       proxy_pass http://127.0.0.1:32400;
   }

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

Due to active exploitation (CISA KEV), administrators should prioritize this update. Review access logs for suspicious outbound requests originating from the Plex server process.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

CVE-2026-96652 is a Server-Side Request Forgery (SSRF, CWE-918) vulnerability residing in the '/player/timeline' endpoint of Plex Media Server. The flaw exists due to insufficient validation of the 'protocol' parameter, allowing an attacker to inject a full URL. This enables the server to act as a proxy for malicious POST requests. Despite its Medium CVSS score, its inclusion in the CISA KEV catalog and a high EPSS score of 0.94 highlight its critical role in real-world attack chains, often used to bypass firewalls and access internal metadata services or APIs.

Official Vendor Advisories & References

NVD Original English Description

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.

https://forums.plex.tv/t/plex-media-server/30447/711

Source: 9119a7d8-5eab-497f-8521-727c672e3725 · Release Notes

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json

Source: 9119a7d8-5eab-497f-8521-727c672e3725 · Third Party Advisory

https://www.cve.org/CVERecord?id=CVE-2026-96652

Source: 9119a7d8-5eab-497f-8521-727c672e3725 · Third Party Advisory, VDB Entry

https://zmain.info/blog/plex2shell

Source: 9119a7d8-5eab-497f-8521-727c672e3725 · Third Party Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96652

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

SecOps Advisory Dispatch & RSS Feed

Subscribe to Daily Vulnerability Briefings & KEV Alerts

Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.

Slack / Teams / RSS Feed: