AI analysis
Claude Opus · 6 Nov 2026, 10:21 CET
Plex Media Server flaw lets logged-in users make the server fetch arbitrary addresses
Plex Media Server versions before 1.43.3.10861 contain a server-side request forgery flaw that CISA confirms is exploited in the wild. Update to 1.43.3.10861 or later and review who holds accounts on exposed servers.
In plain terms
Plex Media Server is widely used software for streaming personal video and music libraries to other devices. Versions before 1.43.3.10861 contain a server-side request forgery (SSRF) flaw. SSRF means an attacker can trick the server into sending web requests on their behalf. Here, the problem sits in the video transcoding feature, which converts media into formats that playback devices can handle.
Anyone with a valid account on a vulnerable server could make it contact addresses of their choosing. These could include systems on the home or company network that are normally unreachable from outside. CISA has confirmed real-world exploitation. Anyone running Plex at home, in a lab or in an organisation, especially with remote access enabled or shared accounts, should update.