CVE-2026-96655: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

The transcode endpoint accepts a path parameter that the server then fetches without restricting the destination. A logged-in user can point it at loopback services, other hosts on the LAN, or outside addresses, and the request leaves from the Plex server.

On its own the flaw is rated medium: low confidentiality impact, no integrity or availability impact. The attacker needs a valid account on the server and network access to it. The risk is in what the SSRF reaches. A public write-up by the researcher, Zach Main, chains four Plex flaws, including this CVE, into unauthenticated remote code execution as the plex user on servers exposed on port 32400. That write-up does not say which step maps to this CVE, so treat the chain as context, not as a confirmed description of this one flaw.

In practice, a Plex server on a home network or a shared host can be used to probe internal services or cloud metadata addresses that the attacker cannot reach directly.

All Plex Media Server builds before 1.43.3.10861 are affected, according to the CISA CSAF advisory. Exposure is highest when the server is reachable from the internet and has more than one user account, including managed or shared users.

Check the version in the Plex Web app under Settings, then About, or from the server's status page. On Linux with the Debian package:

dpkg -s plexmediaserver | grep Version

Upgrade Plex Media Server to 1.43.3.10861 or later. NAS app stores such as QNAP may deliver the update later than Plex's own downloads, so check the installed build there.

CISA's required action is to apply mitigations per vendor instructions under BOD 26-04 and its forensics triage requirements, and to discontinue use of the product if mitigations are unavailable. The due date for US federal agencies is 2026-11-03.

Until you patch, avoid exposing port 32400 directly to the internet and remove accounts you do not need. These are general hardening steps, not vendor-documented workarounds.

The sources give no log signatures for this flaw. Review the Plex server logs for requests to /video/:/transcode/universal from accounts that do not normally stream, especially with a path parameter pointing at an internal address, a loopback address or an unfamiliar hostname. Check firewall or proxy logs for outbound connections from the Plex host to destinations it does not normally contact.

Because CISA lists the CVE as exploited, also look for signs of the wider chain described in the researcher's write-up: unexpected new .so files in the Plex Codecs directory and unexpected changes to transcoder preferences.

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.