CVE-2026-96652

What is Plex Media Server?

Plex Media Server is self-hosted media library software. It catalogues a user's films, television, music, and photos, transcodes them on demand, and streams them to Plex client apps on phones, televisions, consoles, and browsers. It runs on Windows, macOS, Linux, FreeBSD, Docker, and most consumer NAS appliances, listens on TCP port 32400, and offers a remote access feature designed to make the server reachable from outside the home.

Hundreds of thousands of these servers are exposed to the internet. They typically sit on residential connections with clean IP reputations, run on hardware nobody monitors, and have read access to a household's file shares. For an attacker that is an appealing combination: free compute for mining, a residential egress point to resell as proxy capacity, and a foothold inside a home network.

Overview

CVE-2026-96652 is a server-side request forgery in the player timeline endpoint. The endpoint's authentication check only tests whether an X-Plex-Token header is present, not whether the token is valid, so any value at all gets a caller through. The protocol parameter of a player subscription is then inserted into the callback URL without validation, which lets the caller supply a full URL and force the server to send a POST request to a destination of their choosing.

In isolation the impact looks small. NVD scores it 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), and the researcher's own table lists 4.3 to 5.3 depending on version of the standard. An attacker gets blind outbound requests from the server, which is useful for internal network mapping but is not by itself a compromise.

Its importance is positional: this is the front door of the chain the researcher named Plex2Shell. The request Plex makes on the attacker's behalf originates from the loopback interface, and Plex trusts loopback. That trust unlocks the internal agent and plugin API reached through CVE-2026-96654, which in turn leads to the token disclosure in CVE-2026-96655 and the arbitrary file write and code execution in CVE-2026-96656. Every observed in-the-wild attack begins here, which is why a medium-severity SSRF carries a KEV listing.

Affected Versions

Plex states that 1.43.3.10861 and later are not affected, and that any internet-reachable server on an older build should be treated as possibly compromised.

Technical Details

The CWE is CWE-918, server-side request forgery. In plain words, the server fetches a URL that the caller controls, so the caller borrows the server's network position and its identity as a client. Here two separate weaknesses combine. The first is a presence-only credential check: the handler confirms that the X-Plex-Token header exists and never validates it, so the CVSS privileges-required rating of Low overstates the real barrier, which is nil. The second is unvalidated URL construction: the unsubscribe callback for a player subscription builds its target from the protocol value, and supplying a complete URL there replaces the intended scheme and host.

The resulting request is a POST issued by the Plex process. Two things make it more dangerous than a typical blind SSRF. It can be aimed at 127.0.0.1, where Plex grants privileges it denies to external callers, and attackers in the wild have used wildcard DNS services such as sslip.io to express the target host in a form that passes string handling unchanged. Attack complexity is low, no user interaction is needed, and a single HTTP request is enough.

Discovery

The chain was found by independent researcher Zach Main, who reported it to Plex on 2026-07-27. Plex confirmed the findings on 2026-08-04 and paid a bug bounty. Main withheld details for six weeks after the fix shipped, publishing the write-up at zmain.info and the proof-of-concept chain on GitHub under code-zm/plex2shell on 2026-10-16. Subsequent in-the-wild activity was captured and documented by BoredHackerBlog from an internet-facing honeypot.

Exploitation Context

Exploitation is confirmed by Plex, by honeypot capture, and by the KEV listing. The first attempts arrived on the morning of 2026-10-17, roughly a day after the proof of concept was published, and the captured requests match the published chain closely enough to suggest the public code is being run with little modification.

The honeypot recorded the opening request of each attack as a crafted protocol parameter sent to /player/timeline/subscribe, with a Python-urllib/3.10 user agent and token-style identifiers consistent with scripted mass exploitation. Source addresses were 45.194.92.222, 91.92.40.202, and 176.65.139.228; payloads were served from 217.60.194.116. The end state in observed cases was an XMRig cryptominer and a residential proxy binary called myawesomeproxy beaconing to proxystream.st.

Exposure is large. Shadowserver began daily scanning on 2026-09-04 and counted more than 36,000 internet-exposed Plex servers still running 1.43.2 or earlier, out of a far larger population of exposed instances. No ransomware use and no state-actor attribution have been reported.

Remediation

1. Update Plex Media Server to 1.43.3.10861 or later. Verify the running version under Settings > General in Plex Web rather than trusting the installer or package version.
2. Update Plex Desktop to 1.115.0 where it is installed.
3. Disable remote access if you do not need it, and stop forwarding TCP port 32400 to the internet. Reach the server through a VPN or an authenticating reverse proxy instead.
4. Treat any internet-reachable server that ran an older build after 2026-10-16 as potentially compromised, and investigate rather than simply patching.
5. Review logs for requests to /player/timeline/subscribe carrying an unusual protocol value, for the source IPs listed above, and for a Python-urllib user agent.
6. Check for the downstream artefacts of a full chain: unexpected .so or .dll files in the Codecs folder, processes named myawesomeproxy, mylovelyminer, x12345, or xmrig, outbound traffic to proxystream.st or 217.60.194.116, and sustained CPU load while nothing is playing.
7. If compromise is suspected, rebuild from a clean installation, clear the Codecs folder, check Preferences.xml for unexpected transcoder options, sign out all devices, change the Plex account password, and treat every share the Plex service account could read as exposed.
8. Federal civilian agencies must remediate by 2026-11-03 under BOD 22-01. Because a working public exploit exists, patch sooner if the server is reachable from the internet.