Plex Media Server - SSRF WAF Rule by crowdsecurity | CrowdSec Hub

Plex Media Server - SSRF

WAF rulehttp:exploitcve.CVE-2026-96652MITRE T1059cwe.CWE-918

By: crowdsecurity
Version: 0.1
Name: crowdsecurity/vpatch-CVE-2026-96652

Detects Plex Media Server player timeline SSRF via a URL in the protocol parameter.

Install with a top-level collection

1 collection include it

sudo cscli collections install ZoeyVid/npmplus

Installs 5 parsers and 54 scenarios, via WAF - Virtual Patching.

View NPMplus →

Installation

sudo cscli appsec-rules install crowdsecurity/vpatch-CVE-2026-96652

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

appsec-rules/crowdsecurity/vpatch-CVE-2026-96652.yaml· 35 linesGitHub

1name: crowdsecurity/vpatch-CVE-2026-96652
2description: 'Detects Plex Media Server player timeline SSRF via a URL in the protocol parameter.'
3rules:1
4  - and:
5      - zones:2
6          - URI
7        transform:3
8          - urldecode
9          - lowercase
10        match:4
11          type: contains
12          value: '/player/timeline'
13      # a legitimate client sends a bare scheme (http, https): any other character means a URL1
14      - zones:2
15          - ARGS
16        variables:1
17          - protocol
18        transform:3
19          - urldecode
20          - lowercase
21        match:4
22          type: regex
23          value: '[^a-z]'
24
25labels:5
26  type: exploit
27  service: http
28  confidence: 3
29  spoofable: 0
30  behavior: 'http:exploit'
31  label: 'Plex Media Server - SSRF'
32  classification:
33    - cve.CVE-2026-96652
34    - attack.T1059
35    - cwe.CWE-918

Installed on

Know where it runs

Documentation

This rule provides virtual patching for CVE-2026-96652, an SSRF vulnerability in Plex Media Server, published on 2026-09-23, with a CVSS score of 5.3 (Medium). It is part of the Plex2Shell exploitation chain.

Detection: Detects requests to the /player/timeline endpoints whose protocol parameter holds anything but a bare scheme, i.e. a callback URL.

Virtual patching mitigates exploitation attempts, but it does not fix the underlying vulnerability: upgrading Plex Media Server to 1.43.3.10861 or later is always recommended.