Plex Media Server handles playback progress for clients that report their position during a stream. In releases before 1.43.3.10861 the endpoint used for those timeline updates accepted a URL in its protocol parameter and passed that URL to a server-side request. The CNA record for CVE-2026-96652 describes the result in one sentence: an attacker who supplies any X-Plex-Token value can force the server to POST to a destination of their choosing. The flaw sits in the server's request handling, not in a client application, so the affected component is the media server itself.

Vulnerability overview

CVE-2026-96652 is a server-side request forgery (SSRF) issue rated CWE-918. The CNA assigns CVSS v3.1 base score 4.3 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, and a CVSS v4.0 score of 5.3. The same record lists affected versions as below 1.43.3.10861 and marks that version unaffected. CISA's SSVC entry for the identifier records Exploitation as none, Automatable as no and Technical Impact as partial at the time of publication.

Mechanism and exploitation conditions

The timeline endpoint receives the playback position from a client and forwards state to a media session. According to the CNA description, the protocol value can be a complete URL rather than a scheme name. When the server processes that value it issues an HTTP POST to the supplied address. The attacker's control therefore begins with the ability to reach /player/timeline and ends with the server making an outbound request from inside the network where Plex runs.
The authentication detail matters. The record states that any X-Plex-Token value works, which places the practical prerequisite at reaching the endpoint with a header rather than at holding a valid account token. Privileges Required is listed as low and User Interaction as none, consistent with an attacker who must hold some token-shaped credential but does not need an interactive victim.

Impact

Integrity impact is none and confidentiality impact is low in the v3.1 vector, with no availability impact. That scoring fits a primitive whose main value is the request itself. A POST from a trusted server can reach endpoints that refuse connections from the internet, and the response handling on the Plex side determines what the attacker learns. The CNA record does not claim remote code execution and the SSVC technical impact rating of partial supports reading this as an internal request primitive rather than a full compromise.

Affected products and scope

Every Plex Media Server build before 1.43.3.10861 carries the affected timeline handling. The record names a single product, Plex Media Server, and does not identify a platform-specific variant. Installations that are reachable from untrusted networks and installations on networks where other services trust the media host both fall inside the useful scope for an attacker.

Exposure context

A ZoomEye query for app="Plex Media Server" returned 507,974 matching assets when this article was prepared. That number describes servers whose fingerprints match the product. It does not count confirmed vulnerable hosts, and the CVE-specific filter query vul.cve="CVE-2026-96652" returned no matches, which is expected for a recently published identifier. Treat the product figure as a measure of how common the software is, not as an incident count.

Remediation and mitigations

Upgrade to Plex Media Server 1.43.3.10861 or later. The release notes for that build list security entries without mapping each one to an identifier, so the safe reading is that the version boundary in the CNA record is the boundary to apply. Where an immediate upgrade is not possible, restrict who can reach the server's HTTP interface, and treat the Plex host as a system that should not be able to initiate arbitrary outbound HTTP requests. Log review should look for POST requests issued by the server shortly after timeline activity.

References

  1. 1.

    CVE-2026-96652 record, https://www.cve.org/CVERecord?id=CVE-2026-96652

  2. 2.

    CNA record, https://cveawg.mitre.org/api/cve/CVE-2026-96652

  3. 3.

    CISA CSAF advisory va-26-266-01, https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json

  4. 4.

    Plex Media Server 1.43.3.10861 release notes, https://forums.plex.tv/t/plex-media-server/30447/711