CVE-2026-96655: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

According to SentinelOne, the vulnerability resides in Plex Media Server's universal transcoding endpoint at /video/:/transcode/universal.[2] SentinelOne says an authenticated user can supply an arbitrary URL[2], which makes the server fetch content from internal hosts or outside systems.Miggo's database states that the flaw affects Plex Media Server before 1.43.3.10861[3]. OffSeq lists its CVSS 3.1 score as 4.3 medium[4], and The Hacker News reports a score of 5.3.SentinelOne notes that the bug does not directly grant code execution[2] on its own. However, Gizmodo reports that a chain of four vulnerabilities, including CVE-2026-96655, lets an attacker trick a server into handing over its owner's admin token, then plant a malicious file[5]. Plex fixed them in Plex Media Server 1.43.3.10861 released on August 3, 2026.[6]SecurityWeek reports that the researcher released a write-up and proof-of-concept (PoC) code on October 16.[1] The outlet says it has contacted Plex for comment[6].SentinelOne advises administrators to apply egress filtering so the Plex host cannot reach internal management networks, cloud metadata endpoints[2].