From loopback to owner token: the middle of the Plex Media Server chain
From loopback to owner token: the middle of the Plex Media Server chain Two of the four Plex Media Server CVEs fixed in 1.43.3.10861 do the quiet work. CVE-2026-96654 opens internal agent functions to a request that came from outside. CVE-2026-96655 turns that into the server owner's administrative token. Neither scores above medium. CVE-2026-96654: what searchOne does with a URL The NVD record…
CVE-2026-96654 and CVE-2026-96655 are two of four critical vulnerabilities affecting Plex Media Server as of 1.43.3.10861. The first vulnerability, CVE-2026-96654, allows external requests to access internal agent functions through an incorrectly neutralized URL value. This could enable an attacker to call other plugins with arbitrary parameters.
The second vulnerability, CVE-2026-96655, involves the server owner's administrative token being revealed, which could lead to full control of the server. These vulnerabilities work together in a specific order to enable an unauthenticated remote attacker to execute arbitrary code with the privileges of the Plex Media Server process.
Detecting these vulnerabilities is difficult as the middle steps appear as normal Plex behavior. To mitigate these vulnerabilities, users should disable remote access, authenticate every request before forwarding to Plex, rotate the owner token, and update to version 1.43.3.10861 or later.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
