CVE-2026-49129 is a server-side request forgery vulnerability in Music Player Daemon (MPD) prior to version 0.24.11. The issue exists in the CurlInputPlugin where the libcurl option CURLOPT_FOLLOWLOCATION is enabled without setting CURLOPT_REDIR_PROTOCOLS_STR to restrict allowed redirect protocols. As a result, an attacker can cause MPD to follow redirects to non-HTTP protocols, bypassing intended scheme restrictions. This can be exploited via MPD commands that initiate URL fetches, potentially allowing interaction with internal or restricted network services. The vulnerability depends on the use of libcurl versions prior to 7.85.0, which do not enforce protocol restrictions on redirects.

An unauthenticated attacker can exploit this SSRF vulnerability to cause MPD to make requests to internal or restricted network services using protocols other than HTTP/HTTPS, such as gopher, ftp, sftp, ldap, dict, rtmp, or rtsp. This could lead to unauthorized access or interaction with internal resources that are otherwise inaccessible, potentially exposing sensitive information or enabling further attacks within the network. The CVSS 4.0 base score is 6.9, indicating a medium severity impact with network attack vector, no privileges or user interaction required, and low scope impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability is fixed in version 0.24.11 of MPD, upgrading to version 0.24.11 or later is recommended once available. Additionally, ensure that libcurl is updated to version 7.85.0 or later, which enforces redirect protocol restrictions. Until patches are applied, avoid exposing MPD to untrusted networks or inputs that could trigger URL fetch commands.