The Plex transcode path that accepts arbitrary hosts, and what that means for internal networks

Transcoding is the busiest part of a media server, and it is also where Plex Media Server before 1.43.3.10861 accepts a host the caller chooses. CVE-2026-96655 records that an authenticated user can request arbitrary internal or external addresses through a path parameter on /video/:/transcode/universal . The detail that separates it from the timeline flaw is the word authenticated.

Vulnerability overview

The CNA assigns CVE-2026-96655 to the transcode path issue and rates it CVSS v3.1 4.3 with CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N , plus CVSS v4.0 5.3, under CWE-918. Low privileges and no user interaction match an attacker who already holds an account on the server. CISA's SSVC assessment records Exploitation as none, Automatable as no and Technical Impact as partial.

Mechanism and exploitation conditions

The universal transcode endpoint takes a path parameter that identifies where the media lives.…