PatchSiren cyber security CVE debrief
CVE-2026-49129 MusicPlayerDaemon CVE debrief
CVE-2026-49129 is a server-side request forgery (SSRF) vulnerability in Music Player Daemon (MPD) versions prior to 0.24.11. The vulnerability exists in the CurlInputPlugin component where CURLOPT_FOLLOWLOCATION is enabled without restricting CURLOPT_REDIR_PROTOCOLS_STR, allowing HTTP redirects to non-HTTP protocols including gopher, ftp, sftp, ldap, dict, rtmp, and rtsp. This bypasses the intended http/https scheme restriction and can be exploited by unauthenticated attackers through MPD commands that initiate URL fetches (add, readcomments, albumart, readpicture, or load). The vulnerability is exploitable on systems running libcurl versions prior to 7.85.0. The issue was disclosed on 2026-05-28 and affects MPD's ability to safely handle external URL fetching, potentially enabling attackers to interact with internal or restricted network services.
- Vendor
- MusicPlayerDaemon
- Product
- MPD
- CVSS
- MEDIUM 6.9
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-28
- Original CVE updated
- 2026-05-29
- Advisory published
- 2026-05-28
- Advisory updated
- 2026-05-29
Who should care
Organizations running Music Player Daemon instances with network-exposed control interfaces, audio streaming services using MPD for remote content fetching, and security teams monitoring for SSRF vulnerabilities in media server infrastructure.
Technical summary
The vulnerability stems from incomplete curl configuration in MPD's CurlInputPlugin. When CURLOPT_FOLLOWLOCATION is set to follow HTTP redirects without CURLOPT_REDIR_PROTOCOLS_STR to restrict allowed protocols, curl will follow redirects to any supported protocol. This allows an attacker who controls a malicious HTTP server to redirect MPD's URL fetch requests to non-HTTP protocols (gopher, ftp, sftp, ldap, dict, rtmp, rtsp), effectively bypassing MPD's http/https scheme restriction. The attacker can trigger this via standard MPD commands that fetch URLs. Systems with libcurl >= 7.85.0 have additional protections, but the configuration gap in MPD remains a vulnerability on older libcurl versions.
Defensive priority
medium
Recommended defensive actions
- Upgrade Music Player Daemon to version 0.24.11 or later
- Ensure libcurl is updated to version 7.85.0 or later
- Restrict network access to MPD control interfaces to trusted hosts only
- Monitor MPD logs for suspicious URL fetch requests involving non-HTTP protocols
- Review and validate any custom MPD configurations that enable remote URL fetching
- Consider implementing network segmentation to limit MPD's ability to reach internal services
Evidence notes
Vulnerability confirmed through official MPD commit fixing the issue, GitHub issue #2487, and release notes for version 0.24.11. VulnCheck advisory provides additional technical context. CVSS 4.0 vector indicates network attack vector with low attack complexity and no privileges required.
Official resources
2026-05-28