PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-49129 MusicPlayerDaemon CVE debrief

CVE-2026-49129 is a server-side request forgery (SSRF) vulnerability in Music Player Daemon (MPD) versions prior to 0.24.11. The vulnerability exists in the CurlInputPlugin component where CURLOPT_FOLLOWLOCATION is enabled without restricting CURLOPT_REDIR_PROTOCOLS_STR, allowing HTTP redirects to non-HTTP protocols including gopher, ftp, sftp, ldap, dict, rtmp, and rtsp. This bypasses the intended http/https scheme restriction and can be exploited by unauthenticated attackers through MPD commands that initiate URL fetches (add, readcomments, albumart, readpicture, or load). The vulnerability is exploitable on systems running libcurl versions prior to 7.85.0. The issue was disclosed on 2026-05-28 and affects MPD's ability to safely handle external URL fetching, potentially enabling attackers to interact with internal or restricted network services.

Vendor
MusicPlayerDaemon
Product
MPD
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-07-14
Advisory published
2026-05-28
Advisory updated
2026-07-14

Who should care

Organizations running Music Player Daemon instances with network-exposed control interfaces, audio streaming services using MPD for remote content fetching, and security teams monitoring for SSRF vulnerabilities in media server infrastructure.

Technical summary

The vulnerability stems from incomplete curl configuration in MPD's CurlInputPlugin. When CURLOPT_FOLLOWLOCATION is set to follow HTTP redirects without CURLOPT_REDIR_PROTOCOLS_STR to restrict allowed protocols, curl will follow redirects to any supported protocol. This allows an attacker who controls a malicious HTTP server to redirect MPD's URL fetch requests to non-HTTP protocols (gopher, ftp, sftp, ldap, dict, rtmp, rtsp), effectively bypassing MPD's http/https scheme restriction. The attacker can trigger this via standard MPD commands that fetch URLs. Systems with libcurl >= 7.85.0 have additional protections, but the configuration gap in MPD remains a vulnerability on older libcurl versions.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Music Player Daemon to version 0.24.11 or later
  • Ensure libcurl is updated to version 7.85.0 or later
  • Restrict network access to MPD control interfaces to trusted hosts only
  • Monitor MPD logs for suspicious URL fetch requests involving non-HTTP protocols
  • Review and validate any custom MPD configurations that enable remote URL fetching
  • Consider implementing network segmentation to limit MPD's ability to reach internal services

Evidence notes

Vulnerability confirmed through official MPD commit fixing the issue, GitHub issue #2487, and release notes for version 0.24.11. VulnCheck advisory provides additional technical context. CVSS 4.0 vector indicates network attack vector with low attack complexity and no privileges required.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-49129 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-49129

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-49129 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-49129

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.