Plex Media Server SSRF Vulnerability (CVE-2026-96655) Risk Analysis

Plex has patched an authenticated Server-Side Request Forgery (SSRF) vulnerability in Plex Media Server tracked as CVE-2026-96655. The bug sits within the handling of the /video/:/transcode/universal endpoint, where an authenticated user can manipulate path parameters to coerce the server into issuing HTTP requests to arbitrary internal or external network addresses.

Mechanics of the /video/:/transcode/universal Path

The flaw stems from insufficient input validation on parameters passed to the media server’s universal transcoding endpoint. Under normal operations, this endpoint processes client requests to dynamically stream and transcode video content across different bitrates and container formats. However, an authenticated user—even one with low privileges, such as a user with shared library access—can supply crafted parameter values that force the host process to forge outbound requests.

Because these requests originate directly from the host running Plex, an attacker can use this SSRF (CWE-918) to probe internal network subnets, scan local loopback services (127.0.0.1), or query cloud instance metadata endpoints (such as 169.254.169.254 on AWS, Azure, or GCP). In isolation, the issue carries a CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting that it requires authentication and primarily exposes low-level information disclosure without direct integrity or availability impact.

Vulnerability Chaining and Operational Risk

Relying strictly on the low CVSS severity or the current EPSS score of 0.22% (12th percentile) understates the operational threat. CVE-2026-96655 is explicitly designed to be chained alongside three companion vulnerabilities: CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.

In enterprise, hosting provider, or home-lab environments where media servers reside on internal management VLANs, an SSRF serves as a crucial pivoting mechanism. An attacker who has acquired valid low-privilege credentials can use the SSRF to bypass perimeter firewalls and reach unauthenticated local services or admin interfaces on the host network. When combined with adjacent vulnerabilities in the chain, this request redirection can help extract elevated session tokens, reach internal APIs, or trigger secondary code execution pathways that are otherwise inaccessible from external networks.

Remediation and Action Plan

Organizations and system administrators running exposed instances should prioritize upgrading their software immediately.

• Apply Version Patch: Upgrade all installations to Plex Media Server version 1.43.0.10861 or higher across Linux, Windows, macOS, and containerized deployments.
• Compliance Timelines: Organizations adhering to CISA BOD 26-04 guidance must apply vendor mitigations or discontinue internet-facing deployment of affected instances by the November 3, 2026 deadline.
• Egress Control: Enforce firewall rules or host-based network controls that restrict the media server host from reaching sensitive internal management ports or metadata IP blocks (169.254.169.254).