Security2 hOctober 22, 2026, 11:21

Plex Media Server SSRF flaw CVE-2026-96652 lets attackers force outbound requests

CVE-2026-96652 in Plex Media Server before 1.43.3.10861 lets an attacker place a full URL in the protocol parameter of /player/timeline and force the server to POST to it. The fix ships in build 1.43.3.10861; operators are advised to disable manual port forwarding and review shared accounts.

DEV Community

Open source

CVSS v3.1 score 4.3, v4.0 5.3, CWE-918 SSRF
All Plex Media Server builds below 1.43.3.10861 affected
No user interaction required to trigger the request
ZoomEye counted 507,974 public Plex assets

#Plex

Hackers exploit Plex flaws to turn media servers into zombie PCs

Software

Plex closes free remote streaming loophole for personal media

Security

Ni8mare in n8n: CVSS 10.0 flaw lets one webhook request take over a server

Policy

Plex Media Server SSRF flaw CVE-2026-96652 lets attackers force outbound requests

Hackers exploit Plex flaws to turn media servers into zombie PCs

Plex closes free remote streaming loophole for personal media

Ni8mare in n8n: CVSS 10.0 flaw lets one webhook request take over a server

IAB Tech Lab's ARTF v1.0 lets gRPC agents patch bid requests before auctions