CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF)
An attacker can force the Plex Media Server to send POST requests to arbitrary destinations via the timeline endpoint, potentially accessing internal resources.
- Exploited in the wild
- Since 20 Oct 2026
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-96652?
CVE-2026-96652 is a medium-severity server-side request forgery vulnerability in Plex Media Server, published on 23 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.
Weakness: CWE-918
Which versions are affected by CVE-2026-96652?
It affects 1 product.
Products include Plex Media Server.
How do I fix CVE-2026-96652?
No fix has been published for CVE-2026-96652 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 Nov 2026.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-96652 being exploited?
Yes. Attackers have exploited CVE-2026-96652 in the wild since at least 20 Oct 2026.
Public exploit code: 7 proofs of concept on GitHub.
Other vulnerabilities in Plex Media Server
- CVE-2026-96656 Plex Media Server External Control of File Name or Path
- CVE-2020-5741 Plex Media Server Remote Code Execution
- CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page
- CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF)
- CVE-2018-13415 XML external entity in n/a
Sources
Also known as GHSA-5p7w-r379-3c2m.