HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agentsUDP traffic
Integrations
OverviewMCPFeedsAPI / EnrichSplunkMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog

CVE-2026-96652: Plex Media Server /player/timeline protocol SSRF (Plex2Shell stage 1)

HoneyLabs honeypots recorded 4 probes matching CVE-2026-96652 from 2 distinct source IP addresses in the last 7 days. Severity is rated critical.

This CVE is on CISA's Known Exploited Vulnerabilities list. CISA added it on 2026-10-20.

Request paths that identify it

  • /player/timeline/subscribe?{{*}}protocol=http%3A%2F%2F127.0.0.1

Addresses probing it

Source IPProbesNetworkCountry
154.53.48.2513Contabo Inc.United States
85.11.167.71TechTies Inc.The Netherlands

Networks it comes from

ASNOrganisationProbesSource IPs
AS40021Contabo Inc.31
AS197170TechTies Inc.11

Where it comes from

CountryProbes
United States3
The Netherlands1

Captured requests

  • /player/timeline/subscribe?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&protocol=http%3A%2F%2F127.0.0.1%3A32400%2Fsystem%2Fagents%2Fz%2FsearchOne%3FmediaType%3D1%26lang%3Den%26identi…
  • /player/timeline/subscribe?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&protocol=http%3A%2F%2F127.0.0.1%3A32400%2Fsystem%2Fagents%2Fz%2FsearchOne%3FmediaType%3D1%26lang%3Den%26identi…
  • /player/timeline/subscribe?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&protocol=http%3A%2F%2F127.0.0.1%3A32400%2Fsystem%2Fagents%2Fz%2FsearchOne%3FmediaType%3D1%26lang%3Den%26identi…
  • /player/timeline/subscribe?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&protocol=http%3A%2F%2F127.0.0.1%3A32400%2Fsystem%2Fagents%2Fz%2FsearchOne%3FmediaType%3D1%26lang%3Den%26identi…

HTTP client fingerprints

  • b11cun139_00040013_762905fd_x04f40e7a4d805b1083f79d40aab3f12…
  • b11cun129_00040012_00e483a6_x04f40e7a4d805b1083f79d40aab3f12…

CVE report

CVE report

Open a specific CVE from the CVE tracker.