{"id":"CVE-2026-96652","kind":"vulnerability","aliases":["CVE-2026-96652"],"related":[],"title":"Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'","description":"Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Plex Media Server has a server-side request forgery flaw in its 'protocol' parameter. An attacker who supplies any X-Plex-Token value can make the server POST to a destination of their choice, and the flaw is listed as chainable with CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656.","severity":"high","cvss":5.3,"epss":null,"exploited":true,"exploited_at":"2026-10-20T00:00:00+00:00","products":[{"name":"Plex Media Server","fixed":["1.43.3.10861"],"affected":"< 1.43.3.10861","ecosystem":"vendor"},{"name":"Plex Media Server","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["docker","exploited","nas","plex-media-server","plex2shell","rce-chain","runtime","self-hosted","ssrf","vendor"],"not_affected_if":[],"how_to_check":"Check the Plex Media Server version; affected builds are those below 1.43.3.10861.","fix":"Update Plex Media Server to 1.43.3.10861 or later. CISA BOD 26-04 guidance applies; if no mitigation is available, discontinue use of the product.","status":"open","published_at":"2026-09-23T17:17:23+00:00","first_seen_at":"2026-10-23T19:11:50+00:00","triaged_at":"2026-10-23T22:39:53+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T22:39:53Z","model":"claude-haiku-5-5","output":{"fix":"Update Plex Media Server to 1.43.3.10861 or later. CISA BOD 26-04 guidance applies; if no mitigation is available, discontinue use of the product.","reach":"internet","title":"Plex Media Server: any token can force server-side requests to attacker hosts","impact":"high","summary":"Plex Media Server has a server-side request forgery flaw in its 'protocol' parameter. An attacker who supplies any X-Plex-Token value can make the server POST to a destination of their choice, and the flaw is listed as chainable with CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656.","category":"runtime","who_cares":["plex-media-server","self-hosted","docker","nas"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker forces server requests out; chains to further compromise","analyst_note":"Confirm whether the SSRF works without a valid account and what the chained CVEs add; the CISA KEV entry is at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96652.","how_to_check":"Check the Plex Media Server version; affected builds are those below 1.43.3.10861.","needs_analyst":true,"not_affected_if":[],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.001156,"input_tokens":3244,"output_tokens":1663,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed Plex Media Server version and vendor mitigation from the Plex security advisory and the CISA KEV entry for CVE-2026-96652, and confirm the affected version range.","search":"'-04':172C,198C,229C '-2026':11A,14A,84B,87B,91B,146C,149C,153C '-96652':12A,15A '-96654':85B,147C '-96655':88B,150C '-96656':92B,154C '/player/timeline':9A '1.43.3.10861':5A '26':171C,197C,228C 'accord':161C 'action':157C 'adher':225C 'allow':6A,107C 'appli':158C 'applic':195C 'asset':219C 'attack':55B,109C,135C 'base':176C 'bod':170C,196C,227C 'chain':32B,143C 'chainabl':81B 'choic':74B 'chosen':137C 'cisa':155C,168C,185C 'cloud':201C 'complianc':166C 'contain':96C 'could':106C 'cve':10A,13A,83B,86B,90B,145C,148C,152C 'destin':71B,138C 'discontinu':204C 'docker':22B 'ensur':165C,224C 'evalu':217C 'exploit':23B 'exposur':222C 'flaw':49B,77B 'follow':194C 'forc':127C 'forens':187C 'forgeri':48B,102C 'full':120C 'guidanc':183C,199C 'guidelin':231C 'host':36B 'includ':118C 'instruct':164C 'internet':221C 'list':79B 'make':65B 'media':2A,17A,20A,27B,40B,94C 'mitig':159C,210C 'nas':24B 'note':182C,193C 'paramet':53B,125C 'patch':230C 'plex':1A,16A,19A,26B,39B,61B,93C,114C,129C 'plex-media-serv':25B 'plex2shell':29B 'post':68B,132C 'priorit':173C 'product':208C 'protocol':52B,124C 'rce':31B 'rce-chain':30B 'request':47B,101C 'requir':156C,189C 'respons':215C 'risk':178C 'runtim':33B 'secur':174C 'see':179C,190C 'self':35B 'self-host':34B 'server':3A,18A,21A,28B,41B,45B,67B,95C,99C,130C 'server-sid':44B,98C 'servic':202C 'side':46B,100C 'ssrf':7A,37B,103C 'stakehold':213C 'suppli':57B 'token':62B,115C 'triag':188C 'unavail':212C 'updat':175C 'url':121C,180C,191C 'use':110C,205C 'valu':63B,116C 'vendor':38B,163C 'via':8A 'vulner':104C,140C 'x':60B,113C 'x-plex-token':59B,112C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-23T17:17:23+00:00","kev":{"dateAdded":"2026-10-20","dueDate":"2026-11-03","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"9119a7d8-5eab-497f-8521-727c672e3725","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-96652","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-96652","severity":null,"published_at":"2026-10-20T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:50+00:00","fetched_at":"2026-10-25T16:39:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96652:101","url":null,"severity":null,"published_at":"2026-10-23T21:33:57+00:00","modified_at":"2026-10-23T21:33:57+00:00","first_seen_at":"2026-10-23T21:33:57+00:00","fetched_at":"2026-10-23T21:33:57+00:00","note":"Plex forum notice (updated 2026-10-19) and the CVE record give the affected range as < 1.43.3.10861, fixed in 1.43.3.10861. Plex confirms active exploitation and a public PoC (2026-10-16). Censys supplies the exposure data. I did not save the PoC link or any social posts, so the PoC URL is not linked. Check Point lists '1.43.0.10861', which looks like a typo. Severity stays high because of KEV listing and the chain. CVSS is 4.3 or 5.3 on its own."},{"source":"nvd","external_id":"CVE-2026-96652","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96652","severity":null,"published_at":"2026-09-23T17:17:23+00:00","modified_at":"2026-10-21T13:09:44+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":1078,"url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","title":"Plex: Important Security Update for Plex Media Server v1.43.2 and earlier","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1105,"url":"https://www.cve.org/CVERecord?id=CVE-2026-96652","title":"CVE Record CVE-2026-96652","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1078,"url":"https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319","title":"Plex: Important Security Update for Plex Media Server v1.43.2 and earlier","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1081,"url":"https://censys.com/advisory/cve-2026-96652-cve-2026-96654-cve-2026-96655-cve-2026-96656/","title":"Censys advisory: Plex Media Server RCE chain","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1100,"url":"https://www.bleepingcomputer.com/news/security/cisa-hackers-chain-plex-flaws-in-plex2shell-attacks-to-breach-servers/","title":"CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1101,"url":"https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog","title":"CISA adds six KEVs (Oct 20, 2026)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}