compromised.live Free. No login.
Feed / CVE-2026-96652Also as JSON
WATCHExploited vulnerability Plex Media Server

Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

What's happening and what to do

An attacker with any valid-looking access token can make the Plex server send POST requests to a destination of their choosing, and this flaw is being actively exploited. Plex Media Server. Apply the vendor's update now and check for signs of compromise.

AI summary of the sources on this page. Regenerated when a source changes.

Signals over time

  1. 2026-10-20Added to CISA's Known Exploited Vulnerabilities catalog.
  2. 2026-11-03Federal patch deadline for US agencies.
  3. 2026-11-03 21:55First seen here.

Source text

Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.