CVE-2026-96652

CVE-2026-96652 is a server-side request forgery in the /player/timeline path. NVD says an attacker using any X-Plex-Token value can include a full URL in the protocol parameter and make the server send a POST to a destination of their choice.

It is the first link in the Plex2Shell chain: the researcher uses it to make the server reach its own loopback interface. It is one of four CVEs in the chain called Plex2Shell. The others are CVE-2026-96654, CVE-2026-96655, CVE-2026-96656. Plex Media Server before 1.43.3.10861 is affected.

NVD lists CVSS 3.1 4.3 and CVSS 4.0 5.3 for this CVE. NVD maps it to CWE-918. The CVE was published on 23 September 2026.

A researcher published a write-up on 16 October 2026 and a repository that covers all four CVEs. ThreatWire has not run it. On 17 October 2026 another researcher reported seeing the published code used against an internet-facing honeypot that ran an older Plex version. That is one honeypot, not a confirmed mass campaign. See the ThreatWire article on the full chain for details.

The CVE is not in the CISA KEV catalog as of 19 October 2026.

What to do: update Plex Media Server to 1.43.3.10861 or newer and do not expose port 32400 to the internet unless you need to.