CVE-2026-68004 in SRS
Summary
by MITRE • 08/17/2026
An issue in OSSRS SRS (Simple Realtime Server) <v5.0.213 allows a remote attacker to execute arbitrary code via RTMP publish authorization, vhost-level security configuration (security.enabled), SrsSecurity::check(), trunk/src/app/srs_app_security.cpp, and SRS RTMP listener components
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified in OSSRS SRS versions prior to 5.0.213 represents a critical remote code execution flaw rooted in the server's authentication and authorization mechanisms for Real-Time Messaging Protocol streams. This issue specifically affects configurations where vhost-level security is enabled via the security.enabled directive, which triggers the invocation of the SrsSecurity::check() function located within trunk/src/app/srs_app_security.cpp. The core technical deficiency lies in how the RTMP publish authorization logic processes input parameters during stream ingestion. When a client attempts to publish a media stream, the server validates credentials against configured rules; however, insufficient validation or improper handling of specific payload structures allows an attacker to bypass intended access controls and inject malicious code into the execution context of the SRS process.
From a technical perspective, this flaw exploits weaknesses in the boundary checks and type coercion within the security module's check routine. The vulnerability likely stems from a lack of rigorous sanitization or logic errors that permit crafted RTMP packets to trigger unintended memory operations or command executions on the host system. Because the SrsSecurity::check() function is central to enforcing access policies for vhosts, compromising this component effectively neutralizes the security perimeter designed to protect specific virtual hosts. The attacker can leverage this misconfiguration to achieve arbitrary code execution with the privileges of the user account running the SRS service, which often includes significant system-level permissions depending on deployment practices.
The operational impact of this vulnerability is severe, as it allows a remote, unauthenticated attacker to take full control of the affected server infrastructure. Successful exploitation can lead to complete compromise of the underlying operating system, enabling data exfiltration, installation of persistent backdoors, or use of the compromised host for further attacks against internal networks. Given that SRS is frequently deployed in high-traffic streaming environments handling sensitive media content, such a breach poses substantial risks to confidentiality and integrity. Attackers can manipulate live streams, inject malicious payloads into video feeds, or disrupt service availability by crashing the server process through resource exhaustion techniques facilitated by the code execution capability.
This vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) if the exploitation involves direct command invocation, and potentially CWE-20 Improper Input Validation regarding the failure to sanitize RTMP stream parameters. In terms of MITRE ATT&CK mapping, this flaw facilitates initial access via Remote Services such as RTMP, followed by privilege escalation or lateral movement depending on the service account permissions. It also relates to CWE-94 Improper Control of Generation of Code (Code Injection) if arbitrary code is executed within the application context rather than at the OS level directly through shell commands.
Mitigation strategies must prioritize immediate upgrading to version 5.0.213 or later, where these authorization checks have been hardened and input validation logic corrected. For environments unable to upgrade immediately, administrators should disable vhost-level security configurations if they are not strictly necessary, although this reduces overall security posture. Additionally, deploying the server behind a reverse proxy with strict rate limiting and payload inspection can help mitigate exploitation attempts by filtering malformed RTMP packets before they reach the SRS listener components. Network segmentation is also recommended to isolate streaming servers from critical internal assets, ensuring that even if an attacker gains initial access through this vulnerability, their ability to pivot laterally remains constrained. Regular auditing of security configurations and monitoring for anomalous stream publishing activities can further enhance detection capabilities against such exploitation attempts.