CVE-2026-96652: Plex Media Server SSRF Vulnerability Analysis

A server-side request forgery (SSRF) flaw in Plex Media Server, tracked as CVE-2026-96652, allows authenticated users to force the media server to issue arbitrary HTTP POST requests. By passing a full URL into the protocol parameter alongside any valid X-Plex-Token, an attacker can leverage the host running Plex as an unintended proxy to probe or interact with internal and external HTTP endpoints.

Technical Risk & Attack Vector

The vulnerability carries a CVSS 3.1 score of 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). On paper, the CVSS vector reflects low confidentiality impact, low attack complexity, and a requirement for low privileges, while EPSS puts the 30-day exploitation probability at a low 0.22% (12th percentile). However, evaluating an SSRF purely by its base metrics can underestimate its operational risk.

Because Plex instances typically run within trusted internal networks (LANs) or cloud environments with access to internal services, an attacker capable of forging POST requests can bypass perimeter firewalls. Key risks include:

• Internal Service Interaction: Unlike basic SSRF flaws that only allow GET requests for information gathering, this flaw allows outbound POST requests. This enables attackers to send data payloads to internal REST APIs, administrative portals, or router interfaces that alter configuration settings.
• Cloud Metadata Targeting: In cloud-hosted instances, SSRF endpoints are routinely targeted to query instance metadata services (e.g., 169.254.169.254) to extract temporary credentials.
• Low Authentication Barrier: The vulnerability relies on an X-Plex-Token. Obtaining this token requires minimal permissions—such as a managed account or a low-privilege shared user on the server.

Vulnerability Chaining

CVE-2026-96652 is notably designed to be chained alongside several related vulnerabilities in the same software suite: CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. In structured exploitation scenarios, an attacker uses a low-severity SSRF like CVE-2026-96652 to gain a network foothold or reach localhost-only endpoints, subsequently triggering secondary vulnerabilities that deliver full remote code execution or privilege escalation.

Remediation Guidance

To remediate CVE-2026-96652, administrators should update Plex Media Server to version 1.43.0.10861 or later, which validates inputs passed to the protocol parameter.

If immediate updating is not possible, apply the following controls:

• Egress Control: Enforce outbound firewall rules on the host running Plex Media Server to block traffic to private IP spaces (RFC 1918) and cloud metadata services unless explicitly required.
• Token Management: Audit active X-Plex-Token instances, revoke unused device authorizations, and restrict library sharing to authenticated users.
• Federal Compliance: Enterprise and government agencies subject to CISA BOD 26-04 guidance must apply vendor patches or remove vulnerable instances from network exposure prior to the November 3, 2026 mitigation deadline.