CVE-2026-96652: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

The /player/timeline endpoint only checks that an X-Plex-Token is present. It does not check that the token is valid, so a junk value passes. The protocol parameter then accepts a full URL, and the server sends a POST to it.

That gives an attacker a way to make the Plex server send requests from its own network position. It can reach services bound to loopback or the local network that are not exposed to the internet. The CVSS rates this alone as medium, with low confidentiality impact, because the attacker does not read the response.

The researcher write-up shows why it matters more. It describes the flaw as one step in a chain. In the write-up's account, the server's own loopback requests reach an internal plugin-management API that asks for no token from loopback. The chain, together with other Plex flaws fixed in the same release, leads to an owner-level token and code execution on the host. The write-up links a public proof-of-concept repository.

CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-10-20. Any Plex server reachable from the internet, or by untrusted users on a LAN, is a target. A Plex host often holds media libraries, account tokens and network access to the rest of a home or office network.

Affected: Plex Media Server before 1.43.3.10861. The CISA advisory gives the same range, <1.43.3.10861, and names 1.43.3.10861 as the fixed build. Find your version in the Plex Web app under Settings, then About, or in the server's web interface footer. Plex does not document a command for this in the sources read. If auto-update is off, or the server runs from a NAS app store or a container image, the version may lag behind the current release.

Upgrade Plex Media Server to 1.43.3.10861 or later, through the server's built-in update, the Plex downloads page, or your NAS or container source. The CISA advisory lists 1.43.3.10861 as the fix for this flaw and for four other Plex flaws disclosed together.

CISA's required action: apply mitigations in line with vendor instructions and CISA's BOD 26-04 guidance and its Forensics Triage Requirements, follow BOD 26-04 guidance for cloud services, or stop using the product if mitigations are unavailable. The due date is 2026-11-03. It binds US federal agencies, but other organisations should treat it as a deadline too. Check each server's internet exposure. The sources give no workaround short of upgrading, so do not expose an unpatched server to the internet.

Review the Plex server's logs and reverse-proxy logs for requests to /player/timeline with a protocol parameter that holds a full URL or has an odd X-Plex-Token value. Look for outbound POST requests from the Plex host to destinations it should not contact, and for requests that the server makes to itself on loopback. Check for new or changed Plex plugins, new owner-level tokens or devices on the account, and unexpected files or processes on the host. CISA asks for forensics triage on affected assets, so preserve logs before you upgrade.

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.