CVE-2026-49129: Server-Side Request Forgery (SSRF) in MusicPlayerDaemon MPD
Music Player Daemon (MPD) before version 0.24.11 contains a server-side request forgery vulnerability in CurlInputPlugin where CURLOPT_FOLLOWLOCATION is set without CURLOPT_REDIR_PROTOCOLS_STR, allowing unauthenticated attackers to bypass the http/https scheme restriction by causing a malicious HTTP server to redirect to non-HTTP protocols such as gopher, ftp, sftp, ldap, dict, rtmp, or rtsp. Attackers can trigger this vulnerability via MPD commands that initiate URL fetches, including add, readcomments, albumart, readpicture, or load, to interact with internal or restricted network services on systems running libcurl versions prior to 7.85.0.
AI Analysis
Technical Summary
CVE-2026-49129 is an SSRF vulnerability in Music Player Daemon (MPD) before version 0.24.11, specifically in the CurlInputPlugin. The issue arises because CURLOPT_FOLLOWLOCATION is set without CURLOPT_REDIR_PROTOCOLS_STR, which allows HTTP redirects to non-HTTP protocols such as gopher, ftp, sftp, ldap, dict, rtmp, or rtsp. This enables unauthenticated attackers to bypass scheme restrictions and potentially interact with internal or restricted network services. The vulnerability can be triggered by MPD commands that initiate URL fetches, including add, readcomments, albumart, readpicture, or load. The vulnerability depends on the underlying libcurl version being prior to 7.85.0.
Potential Impact
An unauthenticated attacker can exploit this SSRF vulnerability to cause the MPD service to make requests to internal or restricted network services using non-HTTP protocols. This could lead to unauthorized interactions with internal resources, potentially exposing sensitive information or enabling further attacks within the network. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, no privileges or user interaction required, and low scope impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade MPD to version 0.24.11 or later once available and ensure libcurl is updated to version 7.85.0 or newer. Until official patches are released, avoid exposing MPD to untrusted networks and restrict access to trusted users only.
CVE-2026-49129: Server-Side Request Forgery (SSRF) in MusicPlayerDaemon MPD
Description
Music Player Daemon (MPD) before version 0.24.11 contains a server-side request forgery vulnerability in CurlInputPlugin where CURLOPT_FOLLOWLOCATION is set without CURLOPT_REDIR_PROTOCOLS_STR, allowing unauthenticated attackers to bypass the http/https scheme restriction by causing a malicious HTTP server to redirect to non-HTTP protocols such as gopher, ftp, sftp, ldap, dict, rtmp, or rtsp. Attackers can trigger this vulnerability via MPD commands that initiate URL fetches, including add, readcomments, albumart, readpicture, or load, to interact with internal or restricted network services on systems running libcurl versions prior to 7.85.0.
CVSS v4.0
Score 6.9medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-49129 is an SSRF vulnerability in Music Player Daemon (MPD) before version 0.24.11, specifically in the CurlInputPlugin. The issue arises because CURLOPT_FOLLOWLOCATION is set without CURLOPT_REDIR_PROTOCOLS_STR, which allows HTTP redirects to non-HTTP protocols such as gopher, ftp, sftp, ldap, dict, rtmp, or rtsp. This enables unauthenticated attackers to bypass scheme restrictions and potentially interact with internal or restricted network services. The vulnerability can be triggered by MPD commands that initiate URL fetches, including add, readcomments, albumart, readpicture, or load. The vulnerability depends on the underlying libcurl version being prior to 7.85.0.
Potential Impact
An unauthenticated attacker can exploit this SSRF vulnerability to cause the MPD service to make requests to internal or restricted network services using non-HTTP protocols. This could lead to unauthorized interactions with internal resources, potentially exposing sensitive information or enabling further attacks within the network. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, no privileges or user interaction required, and low scope impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade MPD to version 0.24.11 or later once available and ensure libcurl is updated to version 7.85.0 or newer. Until official patches are released, avoid exposing MPD to untrusted networks and restrict access to trusted users only.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-05-27T17:40:12.738Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a189d28e29bf47b50227a6c
Added to database: 5/28/2026, 7:53:12 PM
Last enriched: 5/28/2026, 7:54:26 PM
Last updated: 5/29/2026, 8:19:14 AM
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.