CVE-2026-96655

Executive Summary

CVE-2026-96655 is a Server-Side Request Forgery (SSRF) vulnerability in Plex Media Server affecting versions prior to 1.43.3.10861. The flaw allows an authenticated user to supply arbitrary internal or external addresses through the path parameter of the /video/:/transcode/universal endpoint, causing the server to issue requests to attacker-controlled destinations. With a CVSS base score of 4.3 and a confidentiality-only impact (C:L), the primary risk is internal network enumeration, metadata service access, and potential bypass of network segmentation by an authenticated attacker.

Technical Analysis

The vulnerability is classified as CWE-918 (Server-Side Request Forgery). According to the NVD description, Plex Media Server before version 1.43.3.10861 "allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter."

The attack surface is the Plex Media Server transcode endpoint, exposed over the network. The descriptor "path parameter" indicates that a user-controllable value embedded in the request path — distinct from a query-string or body parameter — is passed to a server-side routine that performs an outbound request, and that this value is not validated against an allowlist of permitted destinations. Because the server performs the request on the user's behalf, the attacker's request originates from the Plex host itself, inheriting its network position and trust relationships.

Key technical properties derivable from the available data:

• Authentication requirement: The flaw requires an authenticated session (PR:L). This reduces the population of potential attackers to users holding valid Plex credentials, including shared-library users or managed accounts, but does not eliminate risk in environments exposing the server to untrusted networks.
• No user interaction: UI:N — exploitation is scriptable and requires no victim action beyond authentication.
• No scope change: S:U — the vulnerable component and the impacted component are the same security authority, meaning the blast radius is bounded by the privileges and network reachability of the Plex server process.
• Confidentiality-only impact: C:L with I:N/A:N. This is consistent with an SSRF used for information disclosure — reading responses from internal services, cloud instance metadata endpoints, or localhost-bound administrative interfaces — rather than for code execution or data modification.

No CVE record confirms the specific validation routine, parameter name within the path, or the internal request library involved. Those implementation details should not be assumed. What is certain from the description is the injection point (the transcode universal path parameter) and the outcome (arbitrary internal or external address requests).

The likely root cause class is the absence of, or an inadequate, destination allowlist and missing resolution-then-validation checks. Typical deficiencies in this class include failure to block loopback, link-local (169.254.0.0/16), and RFC1918 ranges; failure to re-validate after DNS resolution (allowing DNS rebinding); and permissive redirect following. These are named as common SSRF failure modes — the data provided does not confirm which apply to this specific build.

At the time of writing, patch confidence is 0/4 with no patch evidence from any tracked source, no public PoC, no Nuclei template, and no exploit code. CISA KEV status is NO. EPSS has not been scored by FIRST.org.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred at the vulnerability-class level from the NVD description. No specific function names, classes, or parameters beyond those in the description are asserted.

1. Reconnaissance and target identification The attacker identifies an internet- or intranet-reachable Plex Media Server and confirms the version is below 1.43.3.10861. Public Shodan-style fingerprinting of Plex instances (product/title/HTML signatures) makes this step low-cost. The attacker must hold valid credentials — obtained through legitimate sharing, a purchased or leaked account, or credential stuffing against weakly protected instances.

2. Triggering the flaw class Once authenticated, the attacker crafts a request to the /video/:/transcode/universal endpoint in which the path parameter carries an attacker-chosen destination address rather than a legitimate media path. Because the server does not restrict the destination, the request is issued server-side to whatever address the attacker specifies — an internal host, a loopback service, or a cloud metadata endpoint.

3. Payload/execution method (vulnerability-class level) The "payload" in an SSRF is a target URL or address, not executable code. The attacker iterates candidate addresses (e.g., internal management interfaces, the instance metadata service at the cloud provider's link-local address, other hosts in the Plex server's subnet) and observes timing, status, or content differences returned through the transcode request. Any data returned to the attacker constitutes a read primitive; blind SSRF remains useful for port scanning and service discovery via response-time or error-behavior differentials.

4. Post-exploitation impact Successful exploitation yields an information-disclosure primitive from the perspective of the Plex host. Practical consequences include mapping internal network topology, reaching administrative interfaces bound to localhost, and retrieving instance metadata that may include short-lived cloud credentials. The attacker can then pivot using any credentials or trust relationships discovered. Impact is bounded by S:U, C:L, and no integrity or availability effect under the assigned vector; there is no evidence in the provided data that this flaw alone enables remote code execution.

Impact Assessment

The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N produces a base score of 4.3 (Medium). Subscore interpretation:

• AV:N — the vulnerable endpoint is reachable over the network; the server need not be internet-facing, since the SSRF originates from within the network trust boundary.
• AC:L — no special conditions or race windows are required; a single crafted request suffices.
• PR:L — valid credentials are required, which is the principal limiting factor. This includes shared and managed users in typical Plex deployments, so the effective attacker population may be larger than "administrators only."
• UI:N — no victim interaction; fully automatable.
• S:U — no security-authority change; exposure is limited to what the Plex process can itself reach.
• C:L / I:N / A:N — limited confidentiality impact only. No confirmed integrity or availability consequences.

Business impact: In home and small-business Plex deployments, the SSRF can expose the host's local services and LAN topology. In enterprise environments where Plex servers are co-located with other assets — a common "shadow IT" pattern — the flaw provides a foothold for internal reconnaissance and can reach cloud instance metadata, potentially yielding credentials with broader access than the Plex service itself. Blast radius is defined by the network position of the Plex server: a segmented host yields limited reach, while an unsegmented host on a flat internal network can enumerate a large address space. There is no evidence of wormable behavior, and no KEV listing, indicating no confirmed exploitation in the wild as of this report.

Detection Guidance

Sigma Rule

title: Plex Media Server SSRF Attempt via Transcode Universal Path Parameter
id: 6b4f1c2a-9d3e-4a71-8c55-plexssrf0001
status: experimental
description: Detects request paths targeting the Plex /video/:/transcode/universal endpoint that carry non-media or internal address values in the path parameter, consistent with CVE-2026-96655 SSRF attempts.
author: valtersit.com
date: 2026/01/01
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-96655
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains: '/video/:/transcode/universal'
  selection_ssrf_indicators:
    cs-uri-query|contains:
      - '127.0.0.1'
      - 'localhost'
      - '169.254.169.254'
      - 'file://'
      - 'http://10.'
      - 'http://192.168.'
      - 'http://172.16.'
      - 'metadata.google.internal'
  condition: selection_endpoint and selection_ssrf_indicators
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate local transcode targets configured by administrators
level: medium

YARA Rule

rule CVE_2026_96655_Plex_SSRF_Indicators
{
    meta:
        description = "Detects Plex Media Server SSRF exploitation artifacts referencing the transcode universal endpoint with embedded internal/metadata addresses (CVE-2026-96655)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-96655"
        severity = "medium"

    strings:
        $endpoint = "/video/:/transcode/universal" ascii nocase
        $addr1 = "169.254.169.254" ascii
        $addr2 = "metadata.google.internal" ascii nocase
        $addr3 = "127.0.0.1" ascii
        $addr4 = "localhost" ascii nocase

    condition:
        $endpoint and any of ($addr*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-96655 Plex Media Server SSRF Attempt via Transcode Universal Path"; flow:established,to_server; http.uri; content:"/video/:/transcode/universal"; http.uri; content:"169.254.169.254"; nocase; sid:90096655; rev:1; metadata:reference nvd,cve CVE-2026-96655; classtype:attempted-recon;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [http where url.path : "/video/:/transcode/universal" and url.query : ("127.0.0.1","localhost","169.254.169.254","metadata.google.internal")]
  [http where url.path : "/video/:/transcode/universal"]

Splunk SPL Query

index=web OR index=proxy
| eval uri = coalesce(uri_path, url) . "?" . coalesce(uri_query, "")
| where match(uri, "(?i)/video/:/transcode/universal")
| where match(uri, "(?i)(127\.0\.0\.1|localhost|169\.254\.169\.254|metadata\.google\.internal|http://10\.|http://192\.168\.|http://172\.(1[6-9]|2[0-9]|3[01])\.)")
| stats count values(uri) as sampled_uris by src_ip, dest_host
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="web,plex,ssrf,">
  <rule id="100655" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>/video/:/transcode/universal</url>
    <regex>169\.254\.169\.254|127\.0\.0\.1|localhost|metadata\.google\.internal</regex>
    <description>CVE-2026-96655: Possible Plex Media Server SSRF attempt via transcode universal path parameter</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>ssrf,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The version named in the NVD description (1.43.3.10861) is referenced as the fixed version; independent confirmation of the patch has not been obtained from tracked advisory or vendor sources.

1) Immediate mitigations

• Restrict network access to the Plex Media Server management and transcode ports using firewall rules or reverse-proxy ACLs; do not expose the server directly to the internet.
• Enforce strong authentication and audit Plex account sharing; revoke unused shared or managed user accounts, since the flaw requires authenticated access.
• Segment the Plex host from sensitive internal subnets. Block egress from the Plex host to link-local (169.254.0.0/16) and, where feasible, RFC1918 ranges it has no business contacting — this directly defeats the metadata-endpoint and internal-scan use cases.
• Enforce IMDSv2 (session-token-required) on cloud instances so that a simple SSRF cannot retrieve instance credentials.
• Monitor /video/:/transcode/universal access logs for internal-address values in the path parameter (see Detection Guidance).

2) Patch/upgrade steps

• Upgrade Plex Media Server to 1.43.3.10861 or later as indicated by the NVD description.
• Verify the deployed version after upgrade and confirm no downgrade path is exposed.
• Because patch confirmation is currently absent from tracked sources, validate the fix in a staging environment and re-test the transcode endpoint with benign SSRF probes before relying on the upgrade alone.

3) Long-term hardening

• Apply egress filtering and default-deny outbound policy on all media-server hosts — SSRF defenses belong at the network layer as well as in code.
• Isolate media servers in a dedicated VLAN with no lateral trust relationships.
• Implement allowlist-based URL/path validation for any server-side request logic, with post-DNS-resolution re-validation to mitigate DNS rebinding.
• Maintain a software inventory that surfaces "shadow IT" media servers so they receive timely patching, and subscribe to Plex security advisories.

References

• NVD — CVE-2026-96655: https://nvd.nist.gov/vuln/detail/CVE-2026-96655
• CWE-918 (Server-Side Request Forgery): https://cwe.mitre.org/data/definitions/918.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• Plex Media Server security advisories / release notes: https://www.plex.tv/media-server-downloads/ (check for 1.43.3.10861 release notes)
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-96655 NOT currently listed)

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-96655 at the time of writing. No public PoC, Nuclei template, or exploit code was identified in the provided intelligence data.