Plex Media Server SSRF Vulnerability (CVE-2026-96652)

Catalog analysis: CISA added this entry on October 20, 2026. The entry reflects catalog information retrieved on October 21, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-96652 is a Server-Side Request Forgery (SSRF) vulnerability identified in Plex Media Server. The flaw exists within the ‘protocol’ parameter; an attacker utilizing any X-Plex-Token value can provide a full URL in this parameter to force the server to send a POST request to a destination of the attacker’s choosing.

This vulnerability does not exist in isolation and can be chained with three other vulnerabilities: CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. This chaining potential may increase the overall impact of an exploit.

Exposure and applicability

This vulnerability affects organizations and individuals running Plex Media Server. The primary exposure path is through the manipulation of the X-Plex-Token and the ‘protocol’ parameter.

Infrastructure owners should prioritize assets that are internet-facing, as these provide a more direct path for external attackers to trigger the SSRF. Because the vulnerability allows the server to be used as a proxy to send POST requests, it could potentially be used to target other internal systems that trust the Plex server’s IP address.

Remediation priorities

Our analysis suggests the following prioritization for remediation:

1. Immediate Vendor Mitigation: The primary corrective action is to apply mitigations according to official vendor instructions. This should be the first priority for all affected instances.
2. Asset Inventory and Exposure Mapping: Identify all active Plex Media Server installations. Prioritize those with direct internet exposure or those residing in network segments with access to sensitive internal APIs or management interfaces.
3. Chain Analysis: Since CVE-2026-96652 can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656, defenders should verify the status of these related vulnerabilities simultaneously to ensure a comprehensive reduction in exposure.

How to validate remediation

Verifying that a version update was applied is a necessary first step, but it does not prove that the SSRF vector is closed. To provide assurance that exposure has been reduced, we recommend the following validation approach:

• Egress Filtering Audit: Review firewall and egress logs to ensure the Plex server cannot initiate unauthorized POST requests to unexpected external or internal destinations.
• Functional Testing: In a controlled environment, attempt to trigger a request via the ‘protocol’ parameter to a listener owned by the security team. A successful mitigation should result in the server rejecting the malformed protocol parameter or failing to execute the outbound POST request.

Limits and open questions

While vendor instructions provide the path to remediation, there is residual risk if the server remains in a highly permissive network environment where it can reach sensitive internal resources.

It remains unknown whether this vulnerability has been utilized in known ransomware campaigns. Additionally, while CISA has provided a deadline for federal agencies, non-federal organizations must determine their own urgency based on their specific threat model and asset exposure.

Source and editorial note

CVE-2026-96652: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability · Source date: October 20, 2026 · Retrieved October 21, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a Vulnerability Assessment