CVE-2026-96655: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.
Other sources
Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Plex Media Serverto a version that resolves this vulnerability.Fixed in 1.43.3.10861
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to Plex Media Server. The flaw can be exploited remotely over the network and does not require user interaction.
Which deployments are affected?
Plex Media Server versions before 1.43.3.10861 are affected. The available information does not state whether any particular default configuration or exposure setting is required.
What can an attacker do with successful exploitation?
An authenticated attacker can cause the server to send requests to arbitrary internal or external addresses through the /video/:/transcode/universal path parameter. The stated impact is limited to confidentiality; no integrity or availability impact is specified.