SSRF on a media server: the cloud instance case

SSRF vulnerability in Plex Media Server, CVE-2026-96655, poses different risks depending on the deployment context. On a home network, the attacker can access the router and other computers, while on a cloud instance, the attacker targets the instance metadata service, which hands out credentials, project identifiers, and configuration data.

Cloud providers expose instance identity through a link-local address, making it easy for software inside the instance to query it and receive sensitive information. Cloud providers have added defenses like session-token requirements and request hop limits, but these do not make the endpoint irrelevant. The blast radius extends beyond just credentials, as an attacker can also map internal services within a cloud VPC.

Hardening the media server by running it under a limited role, enforcing IMDSv2-style session tokens, and configuring the instance in a subnet with limited internal services can help mitigate the risk. The vulnerability affects Plex Media Server versions 1.43.2 and earlier, with the fix available in version 1.43.3.10861. While CVE-2026-96655 has not yet been indexed in vuln databases, it is crucial to prioritize its remediation in cloud environments, especially before the CISA deadline of November 3, 2026.