{
  "id": 16236995,
  "title": "SSRF on a media server: the cloud instance case",
  "url": "https://urgent.news/2026/10/23/ssrf-on-a-media-server-the-cloud-instance-case",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-23T22:20:21.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/stark_zhuang_df5076f35c68/ssrf-on-a-media-server-the-cloud-instance-case-20n9"
  },
  "original_language": "en",
  "account": "SSRF vulnerability in Plex Media Server, CVE-2026-96655, poses different risks depending on the deployment context. On a home network, the attacker can access the router and other computers, while on a cloud instance, the attacker targets the instance metadata service, which hands out credentials, project identifiers, and configuration data. Cloud providers expose instance identity through a link-local address, making it easy for software inside the instance to query it and receive sensitive information. Cloud providers have added defenses like session-token requirements and request hop limits, but these do not make the endpoint irrelevant. The blast radius extends beyond just credentials, as an attacker can also map internal services within a cloud VPC. Hardening the media server by running it under a limited role, enforcing IMDSv2-style session tokens, and configuring the instance in a subnet with limited internal services can help mitigate the risk. The vulnerability affects Plex Media Server versions 1.43.2 and earlier, with the fix available in version 1.43.3.10861. While CVE-2026-96655 has not yet been indexed in vuln databases, it is crucial to prioritize its remediation in cloud environments, especially before the CISA deadline of November 3, 2026.",
  "summary": "SSRF on a media server: the cloud instance case A media server in a living room and the same software in a cloud virtual machine are not the same risk. CVE-2026-96655, the authenticated server-side request forgery in Plex Media Server, is a good example of why deployment context changes the answer. The flaw lets an authenticated user supply a path parameter to /video/:/transcode/universal that…",
  "key_points": [
    "SSRF vulnerability in Plex Media Server affects cloud instances.",
    "Attackers target instance metadata service for credentials and config data.",
    "Cloud providers' defenses do not render the endpoint irrelevant."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}