CVE-2026-96652: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.
Other sources
Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Plex Media Serverto a version that resolves this vulnerability.Fixed in 1.43.3.10861 - Compensating control
Discontinue use of Plex Media Server if mitigations are unavailable.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs any value in the X-Plex-Token header. No user interaction is required, and the vulnerable endpoint is reachable over the network.
What can an attacker make the Plex server do?
An attacker can supply a full URL in the protocol parameter of /player/timeline, causing the Plex server to send a POST request to an attacker-chosen destination.
Which Plex Media Server versions are affected?
Plex Media Server versions before 1.43.3.10861 are affected. The provided data does not identify any workaround for systems that cannot be updated immediately.