CVE-2026-96654

What is Plex Media Server?

Plex Media Server is self-hosted media library software that indexes a user's films, television, music, and photos, transcodes them on demand, and streams them to client apps on phones, televisions, consoles, and browsers. It runs on Windows, macOS, Linux, FreeBSD, Docker, and most consumer NAS appliances, and listens on TCP port 32400 with a remote access feature intended to make the server reachable from outside the home network.

Part of what Plex does is metadata matching: deciding that a file is a particular film or episode and pulling artwork, cast, and synopsis for it. That work is done by "agents", Python plugins running inside the server's plugin framework, driven through an internal HTTP API under /system/agents/. Because that API is meant to be called only by the server itself, it was built with far weaker access control than anything exposed to the network, which is precisely the assumption this vulnerability breaks.

Overview

CVE-2026-96654 is a URL injection flaw in the agent and plugin API. The identifier value supplied to that API is inserted into an internally constructed URL without being encoded, so characters that delimit a URL's path and query survive into the request. An attacker who can reach the API can therefore redirect the internal call to a different plugin endpoint and attach parameters of their own, which amounts to calling other plugins' functions with attacker-chosen arguments.

Reaching the API is the second half of the problem. It normally requires no token when the request arrives over loopback, and a guard intended to restrict it in agentservice.py is ineffective: the @lock decorator discards the return value of the inner check, so the check runs and its verdict is thrown away. Combined with the unauthenticated SSRF of CVE-2026-96652, which makes the server issue requests to itself from 127.0.0.1, an external attacker inherits loopback trust and the API opens to the internet.

NVD scores the issue 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), and the researcher's table lists 6.5 to 6.9. In the Plex2Shell chain it is the pivot: CVE-2026-96652 gets a request to loopback, this flaw turns that into arbitrary internal plugin calls, CVE-2026-96655 uses the resulting reach to leak the owner's admin token, and CVE-2026-96656 converts that token into a file write and code execution. CISA gave this CVE a three-day deadline of 2026-10-23.

Affected Versions

Plex states that 1.43.3.10861 and later are not affected, and that any internet-reachable server on an older build should be treated as possibly compromised.

Technical Details

NVD records the CWE as CWE-84, improper neutralisation of encoded URI schemes in a web page. That classification sits awkwardly with the actual defect, which is server-side URL construction rather than anything rendered in a browser; CWE-88 (argument injection) or a plain URL-injection reading describes it better. In plain words: the software builds a URL by pasting user input into the middle of it, and because the input is never percent-encoded, a value containing path separators or a query delimiter changes which endpoint is called and what arguments it receives.

The access control failure beside it is worth understanding on its own, because it is a common pattern. A decorator was wrapped around the permission check, and the decorator returns without propagating the check's result. Code that looks guarded is therefore unguarded, and the mistake is invisible at the call site. Plex's own advisory summarises this CVE as access to internal agent functions over the loopback interface.

Attack characteristics: network reachable when chained, low complexity, no authentication, no user interaction. On its own the flaw requires the ability to make the server issue a loopback request, which is exactly what the companion SSRF provides, so in practice the whole chain runs from a single unauthenticated HTTP request to the public port.

Discovery

The chain was reported to Plex on 2026-07-27 by independent researcher Zach Main, who identified the ineffective @lock guard and the unencoded identifier by reading the plugin framework's Python source. Plex confirmed the report on 2026-08-04 and paid a bug bounty. Main published the write-up and a working proof of concept on 2026-10-16, six weeks after the fix shipped in 1.43.3. In-the-wild activity was independently documented by BoredHackerBlog using an internet-facing honeypot.

Exploitation Context

Exploitation of the chain is confirmed by Plex, by honeypot capture, and by the KEV listing. Attacks began on the morning of 2026-10-17, about 24 hours after the proof of concept went public, which points at opportunistic actors running the published code rather than at targeted operations.

The captured traffic shows this stage in action: the initial protocol value sent to /player/timeline/subscribe pointed the server at its own local agent interface by way of an attacker-controlled sslip.io hostname, which is exactly the loopback pivot this CVE depends on. Attacking IPs were 45.194.92.222, 91.92.40.202, and 176.65.139.228, with payloads served from 217.60.194.116 and a Python-urllib/3.10 user agent. The final payloads were an XMRig miner and a residential proxy binary named myawesomeproxy that beacons to proxystream.st.

Shadowserver counted more than 36,000 exposed servers still running 1.43.2 or earlier when it began daily scanning in September 2026. No ransomware use and no state-actor attribution have been reported; the observed motive is cryptomining and proxy resale, helped by the fact that most Plex servers sit on residential IP addresses.

Remediation

1. Update Plex Media Server to 1.43.3.10861 or later, and confirm the version under Settings > General in Plex Web.
2. Update Plex Desktop to 1.115.0 where it is installed.
3. Turn off remote access if it is not needed and stop forwarding TCP port 32400 to the internet. A VPN or an authenticating reverse proxy is a safer way to reach the server.
4. Treat an internet-reachable server that ran a vulnerable build after 2026-10-16 as potentially compromised. This CVE leaves little trace of its own, so look for the chain's end-state artefacts instead.
5. Inspect the Codecs folder for unexpected .so or .dll files, check Preferences.xml for unexpected transcoder options, and look for processes named myawesomeproxy, mylovelyminer, x12345, or xmrig.
6. Block and search logs for the published indicators: 45.194.92.222, 91.92.40.202, 176.65.139.228, 217.60.194.116, and proxystream.st.
7. If compromise is suspected, rebuild from a clean installation rather than cleaning in place, empty the Codecs folder, sign out all devices, change the Plex account password, and treat any share or credential reachable by the Plex service account as exposed.
8. Federal civilian agencies must remediate by 2026-10-23 under BOD 22-01. With a public exploit chain in mass use, every operator should treat this as urgent.