CVE-2026-96655

What is Plex Media Server?

Plex Media Server is self-hosted media library software. It catalogues films, television, music, and photos, then streams them to Plex client apps on phones, televisions, consoles, and browsers. It runs on Windows, macOS, Linux, FreeBSD, Docker, and most consumer NAS appliances, listens on TCP port 32400, and its remote access feature is built to make the server reachable from outside the home network.

The component at issue here is the transcoder. Plex rarely sends a file to a client untouched: it re-encodes on the fly to match the client's codec support and the available bandwidth, through endpoints under /video/:/transcode/. The transcoder is therefore a privileged part of the server that routinely fetches media by URL and spawns an encoder process, which makes it a natural target for anyone looking to turn a media server into something else.

Overview

CVE-2026-96655 is a server-side request forgery in the transcoder. A path parameter of /video/:/transcode/universal is used to fetch media without any allowlist of permitted hosts, so a caller can point the server at arbitrary internal or external addresses and have it issue the request on their behalf. NVD scores it 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), the same modest rating the other SSRF in this chain receives.

The score does not capture what the flaw actually yields. The Plex plugin framework attaches the server owner's admin token to outbound requests whose URL begins with http://127.0.0.1, and that test is an unanchored string prefix match rather than a parse of the host. A hostname that merely starts with those characters satisfies it, so an attacker who can choose the fetch target can receive the owner's admin token at a host they control. Plex's own advisory describes this CVE in exactly those terms, as disclosure of the server owner's admin token, while NVD and CISA describe it as the transcoder SSRF. Both descriptions fit: the SSRF is the mechanism and the token leak is the consequence.

That makes this the credential-theft stage of the Plex2Shell chain. CVE-2026-96652 provides the unauthenticated entry point, CVE-2026-96654 pivots into the internal plugin and agent API, this flaw hands over an owner-level token, and CVE-2026-96656 spends that token on an arbitrary file write that ends in code execution as the Plex service user.

Affected Versions

Plex states that 1.43.3.10861 and later are not affected, and that any internet-reachable server on an older build should be treated as possibly compromised.

Technical Details

The CWE is CWE-918, server-side request forgery: the server fetches a URL chosen by the caller, lending out both its network position and its identity. The transcoder path performs no host validation at all, so loopback addresses, RFC 1918 ranges, cloud metadata endpoints, and arbitrary internet hosts are all reachable from inside the victim's network.

The more instructive defect is the token attachment rule. Deciding whether a URL is local by testing whether the string starts with http://127.0.0.1 is a classic unanchored prefix check: it accepts http://127.0.0.1.attacker.example and anything else that shares the prefix, because it never parses the URL into scheme, host, and path. The correct form of the check is to resolve and compare the host component, not to compare characters. The in-the-wild traffic shows attackers using wildcard DNS services such as sslip.io, which make crafting a hostname of that shape trivial.

Attack characteristics: network reachable, low complexity, no user interaction. CVSS records privileges required as Low because the endpoint expects a token, but within the chain the preceding bugs supply what is needed, so the practical requirement is none. The result is blind SSRF plus a credential disclosure in a single request.

Discovery

The chain was reported to Plex on 2026-07-27 by independent researcher Zach Main, who traced the token leak to the prefix match in the plugin framework. Plex confirmed the findings on 2026-08-04 and paid a bug bounty. Main published a full write-up at zmain.info and a working proof of concept at code-zm/plex2shell on 2026-10-16, six weeks after 1.43.3 shipped. The subsequent exploitation was captured and published by BoredHackerBlog from an internet-facing honeypot.

Exploitation Context

Exploitation is confirmed by Plex, which updated its advisory on 2026-10-19 to call the flaws actively and widely exploited, and by honeypot capture. The first attempts arrived on the morning of 2026-10-17, roughly a day after the proof of concept was released, and the requests closely match the published chain.

Observed source addresses were 45.194.92.222, 91.92.40.202, and 176.65.139.228, with payloads retrieved from 217.60.194.116 and a Python-urllib/3.10 user agent throughout. Post-exploitation payloads were an XMRig-based Monero miner and a residential proxy binary called myawesomeproxy that connects to proxystream.st, alongside files named docker and x. Plex additionally names processes mylovelyminer and x12345.

Shadowserver began daily scans on 2026-09-04 and counted more than 36,000 internet-exposed Plex servers still running 1.43.2 or earlier. No ransomware use and no state-actor attribution have been reported. Beyond the chain, this SSRF deserves attention on its own merits: a Plex server often sits inside a home or small-office network, and a usable SSRF primitive there reaches routers, NAS admin interfaces, and other unauthenticated local services.

Remediation

1. Update Plex Media Server to 1.43.3.10861 or later, and verify the running version under Settings > General in Plex Web.
2. Update Plex Desktop to 1.115.0 where it is installed.
3. Disable remote access if it is not required, and stop forwarding TCP port 32400 to the internet. Use a VPN or an authenticating reverse proxy instead.
4. Assume the owner's admin token was disclosed on any internet-reachable server that ran a vulnerable build after 2026-10-16. Sign out all devices from the Plex account, which invalidates issued tokens, and change the account password.
5. Treat such a server as potentially compromised and investigate: unexpected .so or .dll files in the Codecs folder, unexpected transcoder options in Preferences.xml, processes named myawesomeproxy, mylovelyminer, x12345, or xmrig, and sustained CPU load while nothing is playing.
6. Block and search logs for 45.194.92.222, 91.92.40.202, 176.65.139.228, 217.60.194.116, and proxystream.st, plus outbound requests from the Plex host to unexpected destinations and to sslip.io-style wildcard DNS hostnames.
7. Review what else the Plex host can reach on the local network. The SSRF gives an attacker a request origin inside the perimeter, so check router, NAS, and other management interfaces for unauthorised changes.
8. If compromise is confirmed, rebuild from a clean installation, empty the Codecs folder, and treat every credential and share reachable by the Plex service account as exposed.
9. Federal civilian agencies must remediate by 2026-11-03 under BOD 22-01. With a public exploit chain already in mass use, patch well before that date.