CVE-2026-96652

Executive Summary

CVE-2026-96652 is a Server-Side Request Forgery (SSRF) vulnerability in Plex Media Server versions prior to 1.43.3.10861. An attacker who can reach the Plex server — even with an arbitrary, non-valid X-Plex-Token value — can supply a full URL through the protocol parameter of the /player/timeline endpoint and coerce the server into issuing HTTP POST requests to an attacker-controlled destination. The direct confidentiality impact is limited (CVSS 4.3), but the flaw is valuable as a pivot for internal network reconnaissance, cloud metadata access, and request smuggling behind perimeter controls.

Technical Analysis

The vulnerability is an instance of CWE-918 (Server-Side Request Forgery). The affected component is the /player/timeline endpoint of Plex Media Server. According to the NVD description, the endpoint accepts a protocol parameter whose value is not adequately validated, and the server subsequently performs an outbound HTTP POST to the destination specified in that parameter.

Two properties make this notable:

1. Weak authentication gate. The description states that "any X-Plex-Token value" is sufficient to reach the vulnerable code path. The endpoint does not perform meaningful validation of the token before processing the request, meaning an unauthenticated or low-privileged network attacker does not need a legitimate Plex credential. Functionally, the effective access requirement is "network reachability to the Plex service" rather than a valid account.

2. Full-URL control of an outbound request. The attacker controls the scheme/host/port/path encoded in the protocol parameter, and the server performs the request with its own network position and privileges. Because the method is POST, the server acts as a request-forwarding primitive rather than a simple GET-fetch, which broadens the classes of internal services that can be reached (many internal APIs and administrative interfaces accept or act on POST bodies).

No code-level detail (specific function names, validation routines, or parsing logic) is available in the NVD description, so the precise parsing behavior — e.g., scheme allow-listing, redirect following, DNS rebinding defenses — cannot be asserted. What is derivable is the vulnerability class and mechanism: insufficient input validation of a user-controlled URL in an outbound server request.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects network reachability, low complexity, required (but trivially satisfiable) privileges, no user interaction, no scope change, and low confidentiality impact only. The impact on integrity and availability is scored as none, consistent with an SSRF that is limited to issuing requests rather than modifying the target's data or availability.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for CVE-2026-96652. The attack chain below is inferred strictly from the vulnerability class and the details in the NVD description. No specific implementation names beyond those in the description are asserted.

1. Reconnaissance / target identification. The attacker identifies an internet- or LAN-exposed Plex Media Server instance by fingerprinting the Plex HTTP service (e.g., via Shodan queries such as those in the METADATA section). The attacker confirms reachability of the /player/timeline endpoint and notes the required header form (X-Plex-Token).

2. Triggering the flaw. The attacker crafts a request to /player/timeline carrying an arbitrary X-Plex-Token value together with a protocol parameter set to a full URL under attacker control (e.g., an external collaborator host). Because the token is not meaningfully validated, the request reaches the vulnerable code path.

3. Payload execution (vulnerability-class level). The server parses the supplied URL and initiates an outbound HTTP POST to that destination. The attacker observes the inbound connection or callback on their controlled endpoint, confirming server-side request execution.

4. Post-exploitation impact. With the SSRF primitive confirmed, the attacker redirects the protocol parameter toward internal targets — private-range IP addresses, loopback services, internal admin APIs, or cloud instance metadata endpoints. Because the method is POST, the primitive can reach services that only act on POST. The attacker may use the differential responses (timing, status, error text) as a blind SSRF oracle to enumerate internal hosts and ports, and may be able to exfiltrate data from internal services back to the attacker's listener.

The blast radius of the request injection itself is bounded by the process's outbound network permissions. If the Plex host can egress to the internet and reach internal management networks or a cloud metadata service, the SSRF becomes a meaningful internal pivot.

Impact Assessment

The CVSS 3.1 base score of 4.3 is driven entirely by low confidentiality impact (C:L); integrity (I:N) and availability (A:N) are unaffected. The scope is unchanged (S:U). Business impact is therefore primarily informational and lateral:

• Internal network reconnaissance. The Plex server can be used as an internal request broker, allowing an external attacker to probe systems not directly reachable from the internet.
• Cloud metadata and credential exposure. If the server runs in a cloud environment, the POST primitive can be aimed at instance-metadata endpoints, potentially leaking temporary credentials or configuration — this is a confidentiality impact not captured by the CVSS vector but relevant to risk.
• Perimeter bypass. Firewall rules and network segmentation that trust the Plex host become attack surface; the SSRF enables requests to originate from a trusted source IP.
• Affected systems. Any Plex Media Server instance below 1.43.3.10861 that is reachable by an unauthorized party — including internet-exposed instances and instances on shared internal networks.
• Blast radius. Determined by the Plex host's network position and egress capability, not by the Plex process's own data. There is no evidence of in-the-wild exploitation; CVE-2026-96652 is not listed in CISA KEV and no public exploit exists.

Detection Guidance

Sigma Rule

title: Plex Media Server SSRF via /player/timeline protocol parameter
id: 7b2f1c48-plex-ssrf-96652
status: experimental
description: Detects requests to the Plex /player/timeline endpoint supplying a full URL in the protocol parameter, consistent with CVE-2026-96652 SSRF.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-96652
author: valtersit.com
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains: '/player/timeline'
  selection_param:
    cs-uri-query|contains: 'protocol=' 
    cs-uri-query|re: '(?i)protocol=(?:https?|gopher|file|ftp)'
  filter_internal:
    cs-uri-query|contains: 'protocol=plex'
  condition: selection_endpoint and selection_param and not filter_internal
falsepositives:
  - Legitimate Plex clients that set protocol to a non-URL identifier (tune the regex to observed baseline)
level: high

YARA Rule

rule CVE_2026_96652_Plex_SSRF_Proxy_Log
{
    meta:
        description = "Detects HTTP request lines targeting Plex /player/timeline with a full URL in the protocol parameter (CVE-2026-96652 SSRF)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-96652"
        date = "2026-01-01"
        severity = "high"

    strings:
        $endpoint = "/player/timeline" ascii nocase
        $param    = "protocol=" ascii nocase
        $scheme1  = "protocol=http" ascii nocase
        $scheme2  = "protocol=https" ascii nocase
        $scheme3  = "protocol=gopher" ascii nocase
        $scheme4  = "protocol=file" ascii nocase
        $token    = "X-Plex-Token" ascii nocase

    condition:
        uint16(0) == 0x4854 or true // apply to text/log artifacts
        and $endpoint and $param
        and any of ($scheme*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-96652 Plex Media Server SSRF - /player/timeline protocol parameter with full URL"; flow:established,to_server; http.uri; content:"/player/timeline"; http.uri; content:"protocol="; pcre:"/protocol=(?:https?|gopher|file|ftp)%?(?:3a|3A)?%?2f%?2f/i"; classtype:attempted-recon; reference:cve,2026-96652; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-96652; sid:90096652; rev:1;)

Elastic Detection

network where http.request.method == "POST" and
  url.path : "/player/timeline" and
  url.query contains "protocol=" and
  (
    url.query : "protocol=http*" or
    url.query : "protocol=https*" or
    url.query : "protocol=gopher*" or
    url.query : "protocol=file*"
  )

Splunk SPL Query

index=web OR index=proxy (uri_path="/player/timeline" OR uri="*/player/timeline*")
| rex field=uri_query "(?i)protocol=(?<proto_url>[^&]+)"
| where isnotnull(proto_url)
| eval proto_scheme=mvindex(split(lower(proto_url),":"),0)
| where proto_scheme IN ("http","https","gopher","file","ftp","dict")
| table _time src_ip dest_host method uri proto_url status
| sort - _time

Wazuh OSSEC Rule

<group name="web,plex,ssrf,">
  <rule id="100966" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">/player/timeline</field>
    <regex type="pcre2">protocol=(?:https?|gopher|file|ftp)%?(?:3a|3A)?%?2f%?2f</regex>
    <description>CVE-2026-96652: Plex Media Server SSRF attempt - /player/timeline protocol parameter supplied with a full URL</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack_ssrf,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory, workaround, or affected-version list was provided in the source data. The version boundary below is taken directly from the NVD description ("before 1.43.3.10861").

1) Immediate mitigations

• Restrict network access to Plex Media Server. Do not expose the Plex HTTP interface directly to the internet; place it behind a VPN or an authenticating reverse proxy.
• Apply firewall/egress rules so the Plex host cannot initiate outbound POST connections to untrusted destinations, private RFC1918 ranges, loopback, or link-local/metadata addresses (e.g., 169.254.169.254). Restrict egress to only the specific destinations Plex legitimately requires.
• If the described behavior is not required in your deployment, block or inspect requests to /player/timeline at the reverse proxy and reject requests whose protocol parameter contains a full URL.
• Harden cloud instance metadata (IMDSv2 with hop-limit, or disable if unused) to reduce the value of an SSRF pivot.

2) Patch / upgrade steps

• Upgrade Plex Media Server to version 1.43.3.10861 or later. Confirm the exact fixed version against the official Plex release notes before deploying, since no vendor patch reference was available in the source data for this report.
• Verify the running version after upgrade and restart the service.
• Monitor for any forthcoming official Plex security advisory and reconcile the fixed-version boundary.

3) Long-term hardening

• Adopt an allow-list validation model for any user-supplied URL parameter that results in a server-side request; reject non-permitted schemes and destinations by default.
• Enforce authentication that is actually validated on all API endpoints, including /player/timeline, rather than accepting arbitrary token values.
• Segment media servers from management networks, apply least-privilege egress, and monitor server-originated POST traffic for anomalies.
• Subscribe to Plex security announcements and track CVE-2026-96652 for KEV inclusion and vendor patching status.

References

• NVD — CVE-2026-96652: https://nvd.nist.gov/vuln/detail/CVE-2026-96652
• MITRE CWE-918 — Server-Side Request Forgery: https://cwe.mitre.org/data/definitions/918.html
• FIRST EPSS (CVE-2026-96652 not yet scored at time of writing): https://api.first.org/data/v1/epss?cve=CVE-2026-96652
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-96652 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Plex Media Server release/download page for fixed-version verification: https://www.plex.tv/media-server-downloads/

No threat actor campaign or exploit-in-the-wild evidence is associated with CVE-2026-96652 in the available data; the vulnerability is not listed in CISA KEV, no public PoC or exploit code is available, and no Nuclei template exists as of this report.