Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Plex — Media Server
- Added to KEV catalog
- 20 October 2026
- Federal remediation due date
- 3 November 2026
- Weakness classification (CWE)
- CWE-918
AI Breakdown
What it is
Plex Media Server versions prior to 1.43.3.10861 contain a server-side request forgery flaw in the timeline component. An attacker providing any X-Plex-Token value can insert a custom URL into the protocol parameter. This forces the vulnerable Plex server to send unauthorized POST requests to an arbitrary destination selected by the attacker.
Why it matters
This vulnerability is confirmed to be actively exploited in the wild and can be chained with other security flaws to increase the severity of an attack. While known ransomware involvement is currently unknown, unauthorized network requests initiated by the server can expose internal systems and compromise network integrity.
Recommended action
Update Plex Media Server to version 1.43.3.10861 or newer immediately, following vendor mitigation instructions and CISA BOD 26-04 guidance. Evaluate all assets for internet exposure and follow forensic triage requirements if suspicious activity is detected. If vendor mitigations or patches cannot be applied, discontinue use and isolate the product from the network.
AI-generated from CISA and NVD data — treat as a starting point, not a substitute for your own risk assessment.
CISA Description
Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes
https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-96652
NVD Technical Description
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.
More Plex Vulnerabilities
Plex Media Server External Control of File Name or Path Vulnerability
Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Plex Media Server Remote Code Execution Vulnerability
Is this vulnerability present in your environment?
CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.
Explore VAPT Services