CVE-2026-49129: Music Player Daemon < 0.24.11 SSRF via CurlInputPlugin
Music Player Daemon (MPD) before version 0.24.11 contains a server-side request forgery vulnerability in CurlInputPlugin where CURLOPTFOLLOWLOCATION is set without CURLOPTREDIRPROTOCOLSSTR, allowing unauthenticated attackers to bypass the http/https scheme restriction by causing a malicious HTTP server to redirect to non-HTTP protocols such as gopher, ftp, sftp, ldap, dict, rtmp, or rtsp. Attackers can trigger this vulnerability via MPD commands that initiate URL fetches, including add, readcomments, albumart, readpicture, or load, to interact with internal or restricted network services on systems running libcurl versions prior to 7.85.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libcurlto a version that resolves this vulnerability.Fixed in 7.85.0 - Upgrade
Upgrade
Music Player Daemon (MPD)to a version that resolves this vulnerability.Fixed in 0.24.11 - Configuration
Update CurlInputPlugin to ensure CURLOPT_FOLLOWLOCATION is not used without CURLOPT_REDIR_PROTOCOLS_STR, preventing redirects to non-HTTP/HTTPS protocols (e.g., gopher, ftp, sftp, ldap, dict, rtmp, rtsp) that enable SSRF.
Music Player Daemon (MPD) CurlInputPlugin CURLOPT_FOLLOWLOCATION / CURLOPT_REDIR_PROTOCOLS_STR = Set CURLOPT_REDIR_PROTOCOLS_STR to restrict allowed redirect protocols when CURLOPT_FOLLOWLOCATION is enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49129?
The severity of CVE-2026-49129 is medium with a score of 5.8.
What type of vulnerability is identified in CVE-2026-49129?
CVE-2026-49129 identifies a server-side request forgery (SSRF) vulnerability.
How do I fix CVE-2026-49129?
To fix CVE-2026-49129, upgrade Music Player Daemon to version 0.24.11 or later.
What software is affected by CVE-2026-49129?
CVE-2026-49129 affects Music Player Daemon versions prior to 0.24.11.
What impact can CVE-2026-49129 have on my system?
CVE-2026-49129 allows unauthenticated attackers to bypass http/https scheme restrictions, potentially exposing sensitive information.