AI analysis
Claude Opus · 6 Nov 2026, 10:21 CET
Plex Media Server flaw lets attackers make the server send requests to arbitrary addresses
Plex Media Server before 1.43.3.10861 has an actively exploited server-side request forgery flaw in its /player/timeline endpoint. CISA's remediation deadline of 2026-11-03 has passed. Upgrade to 1.43.3.10861 or later now.
In plain terms
Plex Media Server is software people and organisations run to stream their own video, music and photo libraries to other devices. Versions before 1.43.3.10861 contain a server-side request forgery flaw. Server-side request forgery (SSRF) means an attacker can trick the server into sending web requests on their behalf, to destinations the attacker chooses.
That matters because a media server often sits inside a home or company network. It can reach devices and services that are not visible from the internet. Abusing the server as a relay can expose those internal systems. CISA has confirmed attackers are already using this flaw. Anyone running Plex Media Server, especially on an internet-reachable host, should update.