CVE-2026-49129: MPD Server-Side Request Forgery via Protocol Redirect

Technical summary

The vulnerability exists in MPD's CurlInputPlugin, which handles remote URL fetching. The plugin uses libcurl's CURLOPT_FOLLOWLOCATION option to transparently follow HTTP redirects, but does not restrict which protocols libcurl may redirect to via CURLOPT_REDIR_PROTOCOLS_STR. This combination allows an attacker to host a malicious HTTP server that responds to an MPD client request with a 3xx redirect to a non-HTTP protocol (gopher, ftp, sftp, ldap, dict, rtmp, rtsp). libcurl versions before 7.85.0 default to permissive protocol whitelisting during redirects. The attacker can trigger URL fetches by issuing MPD commands such as add, readcomments, albumart, readpicture, or load. The SSRF enables reconnaissance of internal networks, interaction with restricted services, or potential information disclosure.

Business impact

An attacker can use this vulnerability to map internal network topology, probe for listening services on private subnets, or interact with non-HTTP protocols on systems that should be isolated. On systems where MPD runs with elevated privileges or network access, this could facilitate lateral movement, exposure of metadata from internal repositories, or abuse of backend services (LDAP directories, FTP servers, etc.). The attack requires no authentication and can be triggered remotely, making it a practical threat in environments where MPD is exposed to untrusted networks or serves user-supplied URLs.

Affected systems

Music Player Daemon versions before 0.24.11 are affected. The attack also depends on the victim system running libcurl versions prior to 7.85.0; newer libcurl may mitigate the issue through stricter default protocol filtering. Any installation that processes remote URLs via MPD commands is at risk, including streaming servers, media centers, and automated playlist loaders that accept untrusted input.

Exploitability

This vulnerability is straightforward to exploit: no special client-side tools are needed beyond an HTTP server under the attacker's control. The attacker sets up a redirect from an HTTP endpoint to a target protocol and waits for MPD to request it. The attack vector is network-based, requires no authentication, and can be triggered via standard MPD protocol commands. The complexity is low, making it practical for opportunistic attackers. However, the impact is limited to information disclosure and internal service interaction; remote code execution is not directly achieved.

Remediation

Update Music Player Daemon to version 0.24.11 or later, which explicitly restricts libcurl redirect protocols. Additionally, ensure libcurl is updated to version 7.85.0 or newer for defense-in-depth. Organizations should also restrict MPD's network access through firewall rules and avoid exposing MPD to untrusted networks. If immediate patching is not possible, disable remote URL fetching features or validate and whitelist all URLs that MPD processes.

Patch guidance

Verify the latest MPD release version against the official Music Player Daemon website and apply updates through your distribution's package manager or compile from source. For libcurl dependencies, confirm the version is 7.85.0 or later. Test the updated version in a staging environment to ensure compatibility with existing configurations and playlists. After patching, review MPD's network configuration to ensure it is not unnecessarily exposed.

Detection guidance

Monitor MPD logs for unusual URL requests, particularly those containing protocol schemes other than http or https. Watch for repeated connection attempts from MPD to internal services (FTP, LDAP, gopher ports). Network-level detection can identify traffic from MPD to unexpected protocols or internal IP ranges. Correlate MPD command logs (add, readcomments, albumart, readpicture, load) with unexpected network activity. Anomalous patterns—such as MPD requests followed by connections to internal services—may indicate exploit attempts.

Why prioritize this

This vulnerability merits prompt patching because it enables unauthenticated network-based SSRF attacks on a widely-deployed open-source media player. While the CVSS score is MEDIUM (5.8), the ease of exploitation and potential for lateral movement or information disclosure make it a practical threat in environments where MPD is internet-facing or processes untrusted URLs. Organizations running MPD in media centers, streaming infrastructure, or automation pipelines should prioritize patching. The vulnerability is not in the CISA KEV catalog, indicating lower active exploitation, but should not be deferred indefinitely.

Risk score, explained

The CVSS 3.1 score of 5.8 (MEDIUM) reflects a low attack complexity, no privilege requirement, and network-adjacent attack vector, but limited scope and impact (confidentiality only, no integrity or availability impact). The score appropriately captures the SSRF nature: an attacker can learn information about internal networks and services. However, the practical exploitability and potential for chaining with other vulnerabilities may warrant consideration of organizational context when prioritizing.

Frequently asked questions