CVE-2026-49129 Details
Description
Music Player Daemon (MPD) before version 0.24.11 contains a server-side request forgery vulnerability in CurlInputPlugin where CURLOPT_FOLLOWLOCATION is set without CURLOPT_REDIR_PROTOCOLS_STR, allowing unauthenticated attackers to bypass the http/https scheme restriction by causing a malicious HTTP server to redirect to non-HTTP protocols such as gopher, ftp, sftp, ldap, dict, rtmp, or rtsp. Attackers can trigger this vulnerability via MPD commands that initiate URL fetches, including add, readcomments, albumart, readpicture, or load, to interact with internal or restricted network services on systems running libcurl versions prior to 7.85.0.
A server-side request forgery (SSRF) vulnerability has been identified in Music Player Daemon (MPD) versions prior to 0.24.11. The issue resides in the CurlInputPlugin, where the CURLOPT_FOLLOWLOCATION option is enabled without properly restricting redirect protocols. This flaw allows unauthenticated attackers to bypass HTTP and HTTPS scheme limitations, redirecting to non-HTTP protocols such as gopher, ftp, sftp, ldap, dict, rtmp, or rtsp. Exploitation can be achieved through MPD commands that fetch URLs, like add, readcomments, albumart, readpicture, or load, potentially interacting with internal or restricted network services on systems with libcurl versions before 7.85.0.
Users are advised to update to MPD version 0.24.11 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 28, 2026CISA-ADP
Assessed May 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MusicPlayerDaemon/MPD/commit/78341dd6c7b101c3feede233d4cc4f8f1fcc4bb3 | [email protected] | Source CodeVendor |
| https://github.com/MusicPlayerDaemon/MPD/issues/2487 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/MusicPlayerDaemon/MPD/releases/tag/v0.24.11 | [email protected] | Release NotesVendor |
| https://mstreet97.github.io/security-research/opensource/vulnerability-disclosure/cybersecurity/cve/2026/05/25/Four_Bugs_Reachable_nc.html | [email protected] | |
| https://raw.githubusercontent.com/MusicPlayerDaemon/MPD/v0.24.11/NEWS | [email protected] | Release NotesVendor |
| https://www.musicpd.org/news/2026/05/mpd-0-24-11-released/ | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/music-player-daemon-ssrf-via-curlinputplugin | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Music Player Daemon | < 0.24.11 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | CVE Modified | [email protected] |
| May 28, 2026 | New CVE Received | [email protected] |