CVE-2026-96655 in Media Server
Summary
by MITRE • 09/23/2026
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in Plex Media Server versions prior to 1.43.3.10861 represents a significant security flaw within the application's video transcoding subsystem, specifically affecting the endpoint associated with the universal transcoder path. This issue stems from an improper validation of user-supplied input regarding network destinations, allowing authenticated users to manipulate request parameters to redirect traffic or access resources that should remain inaccessible. The core technical failure lies in the server's handling of the '/video/:/transcode/universal' route, where the application fails to enforce strict allow-listing or sufficient sanitization on address fields passed through path parameters. This lack of rigorous input validation enables an attacker who has valid credentials for a Plex account to construct malicious requests that specify arbitrary internal or external IP addresses and hostnames as targets for transcoding operations.
From a technical perspective, this vulnerability is classified under CWE-918, which pertains to Server-Side Request Forgery (SSRF). SSRF vulnerabilities occur when a web application fetches a remote resource without validating the user-supplied URL, allowing an attacker to cause the server to send crafted requests to unexpected destinations. In the context of Plex Media Server, the transcoder is designed to process media streams, often requiring access to various sources for decoding and re-encoding purposes. However, by failing to restrict these source addresses to a predefined set of trusted internal or external domains, the application inadvertently exposes its underlying network stack to abuse. An authenticated attacker can exploit this mechanism to probe internal networks that are not directly exposed to the public internet, potentially discovering other services running on localhost or within the local area network such as administrative interfaces for routers, databases, or IoT devices.
The operational impact of this vulnerability is multifaceted and extends beyond simple data exfiltration. While direct exploitation might be limited by the nature of HTTP-based transcoding requests, which typically do not return full response bodies to the client in a way that facilitates easy data leakage, the primary risk lies in network reconnaissance and potential further compromise. By forcing the Plex server to make connections to internal services, an attacker can map out the internal network topology, identify open ports, and detect running service versions. This information is critical for planning subsequent attacks against other systems within the same network segment. Furthermore, if any of these internal services are vulnerable to injection or authentication bypass flaws, the SSRF vector could serve as a pivot point, allowing the attacker to leverage the Plex server's privileges and network position to exploit those downstream targets effectively.
This vulnerability aligns with several techniques documented in the MITRE ATT&CK framework, particularly T1598, which covers Phishing for Inbound Information or more broadly SSRF-related activities like T1071 Application Layer Protocol when used to tunnel malicious traffic. The exploitation of this flaw allows an attacker to use legitimate application functionality as a tool for unauthorized network interaction, bypassing traditional perimeter defenses that might not inspect internal-to-internal traffic originating from trusted hosts. Since the attack requires authentication, it targets users who have already gained some level of trust within the system, highlighting the importance of defense-in-depth strategies even after initial access is established.
To mitigate this vulnerability, organizations running Plex Media Server must immediately upgrade to version 1.43.3.10861 or later, where the developers have implemented stricter validation logic for address parameters in the transcoder endpoint. In addition to patching, administrators should review their network segmentation strategies to ensure that critical internal services are not accessible from the host running Plex Media Server unless absolutely necessary. Implementing a web application firewall with rules specifically designed to detect and block SSRF patterns can provide an additional layer of defense by inspecting outbound requests for suspicious destination addresses or protocols. Regular security audits and penetration testing focused on input validation in media processing endpoints will help identify similar weaknesses before they can be exploited, ensuring the integrity and confidentiality of both the media server environment and the broader network infrastructure it resides within.