Detecting exploitation of the Plex timeline SSRF in server and network telemetry

Patching CVE-2026-96652 closes the path that lets a caller force Plex Media Server to issue an outbound POST. Between the advisory and the upgrade there is a window where detection is the only control available. The flaw's mechanics show where to look. First a request to one media endpoint, then an HTTP request leaving the server towards an address with nothing to do with the library.

Vulnerability overview

The CNA record states that Plex Media Server before 1.43.3.10861 allows SSRF via /player/timeline and that an attacker using any X-Plex-Token value can place a full URL in the protocol parameter. CVSS v3.1 is 4.3 with AV:N/AC:L/PR:L/UI:N , CVSS v4.0 is 5.3, and the weakness is CWE-918. CISA's SSVC assessment records Exploitation as none, Automatable as no and Technical Impact as partial.

Mechanism and exploitation conditions

Two requests make up an attempt.…