Live › vulnerability › CVE-2026-96652
Go to dashboardPlex Media Server has a server-side request forgery flaw in its 'protocol' parameter. An attacker who supplies any X-Plex-Token value can make the server POST to a destination of their choice, and the flaw is listed as chainable with CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Plex Media Server | vendor | < 1.43.3.10861 | 1.43.3.10861 |
| Plex Media Server | vendor | – | – |
Check the Plex Media Server version; affected builds are those below 1.43.3.10861.
1.43.3.10861 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
This page as .md · .json · in your agent: get_signal("CVE-2026-96652")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.