Plex Media Server - SSRF (CVE-2026-96652)
Description
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.
psychologyCrowdSec Analysis
CVE-2026-96652 is a server-side request forgery vulnerability in Plex Media Server before 1.43.3.10861. The companion /player/timeline endpoints accept any X-Plex-Token value and build a callback URL from the player-supplied protocol parameter, so an unauthenticated attacker can make the server send POST requests to arbitrary internal or external destinations. It is the entry point of the Plex2Shell exploitation chain.
CrowdSec has been tracking this vulnerability and its exploits since 28th of October 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2026-96652 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers send requests to /player/timeline/subscribe (and other /player/timeline endpoints) with a full URL instead of a scheme in the protocol query parameter, e.g. protocol=http://attacker.example:8080/, to make Plex call back to a host they choose.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-09-23 |
| CISA KEV | 2026-10-20 |
| Rule Released | 2026-10-28 |
| CrowdSec First Seen | 2026-10-28 |
| CISA Remediation Deadline | 2026-11-03 |