PT-2026-44496 · Unknown+1 · Music Player Daemon+1

Daniele Berardinelli + 1 · Published 2026-05-28 · Updated 2026-05-28 · CVE-2026-49129

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Music Player Daemon (MPD) versions prior to 0.24.11

Description A server-side request forgery (SSRF) issue exists in the CurlInputPlugin. The CURLOPT FOLLOWLOCATION option is enabled without specifying CURLOPT REDIR PROTOCOLS STR, which allows unauthenticated attackers to bypass http/https scheme restrictions. By using a malicious HTTP server to redirect requests to non-HTTP protocols—such as gopher, ftp, sftp, ldap, dict, rtmp, or rtsp—attackers can interact with internal or restricted network services. This is possible on systems using libcurl versions prior to 7.85.0. The issue can be triggered via MPD commands that initiate URL fetches, specifically add, readcomments, albumart, readpicture, or load.

Recommendations Update to version 0.24.11 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-49129

Affected Products

Music Player Daemon

Libcurl

References · 10

• 🔥 https://mstreet97.github.io/security-research/opensource/vulnerability-disclosure/cybersecurity/cve/2026/05/25/Four_Bugs_Reachable_nc.html · Exploit
• https://github.com/MusicPlayerDaemon/MPD/commit/78341dd6c7b101c3feede233d4cc4f8f1fcc4bb3 · Patch
• https://musicpd.org/news/2026/05/mpd-0-24-11-released · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-49129 · Security Note
• https://github.com/MusicPlayerDaemon/MPD/issues/2487 · Note
• https://github.com/MusicPlayerDaemon/MPD/releases/tag/v0.24.11 · Note
• https://twitter.com/CVEnew/status/2060091929283498476 · Twitter Post
• https://vulncheck.com/advisories/music-player-daemon-ssrf-via-curlinputplugin · Note
• https://raw.githubusercontent.com/MusicPlayerDaemon/MPD/v0.24.11/NEWS · Note
• https://t.me/cveNotify/165112 · Telegram Post