Source: cisa.gov
Plex Media Server versions v1.43.2 and earlier contain a server-side request forgery (SSRF) vulnerability tracked as CVE-2026-96652. The flaw allows any attacker with a valid X-Plex-Token to inject a full URL into the 'protocol' parameter, forcing the Plex server to make POST requests to attacker-controlled destinations. This vulnerability is part of a chain that includes CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656, which can be combined for greater impact. The issue has been flagged by CISA and is subject to BOD 26-04, which prioritizes security updates based on risk. Forensic triage requirements have also been outlined under BOD 26-04 implementation guidance. Users are urged to update Plex Media Server to a patched version immediately. The vulnerability is documented in both the NVD and CISA advisories.
