CISA adds Plex Media Server SSRF to KEV (CVE-2026-96652)
Original title: CISA KEV: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability — Plex Media Server (CVE-2026-96652)
Any X-Plex-Token can force a POST via /player/timeline on builds before 1.43.3.10861; the due date is November 3.
CISA added CVE-2026-96652, a server-side request forgery flaw in Plex Media Server before 1.43.3.10861, to the Known Exploited Vulnerabilities catalog. Through /player/timeline, an attacker using any X-Plex-Token can put a full URL in the protocol parameter and make the server POST to a chosen destination. Vendor mitigations and BOD 26-04 apply. The due date is November 3, 2026.
Unconfirmed: CISA lists known ransomware campaign use as Unknown.
- The endpoint named is /player/timeline.
- Any X-Plex-Token value is sufficient.
- The protocol parameter can carry a full URL.
- Due date is November 3, 2026, later than the other Plex entries.
Impact: Force the server to POST to an attacker URL
| Product | Affected |
|---|---|
| Plex Media Server | before 1.43.3.10861 |
- 1.Apply vendor mitigations and BOD 26-04.
- 2.Discontinue the product if mitigations are unavailable.
- 3.Meet the November 3, 2026 KEV due date.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-96652 | Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability | 5.3 | 2% | KEVPoC | KEV |
From the original article
1 min read at cisa.govPlex Media Server before 1. 43. 3.
cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.