CVE-2026-68004
Received Received - Intake

Remote Code Execution in OSSRS SRS

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: MITRE

Description
An issue in OSSRS SRS (Simple Realtime Server) <v5.0.213 allows a remote attacker to execute arbitrary code via RTMP publish authorization, vhost-level security configuration (security.enabled), SrsSecurity::check(), trunk/src/app/srs_app_security.cpp, and SRS RTMP listener components

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-18
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-68004
EUVD
EUVD-2026-60448

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ossrs srs 5.0.213
ossrs srs *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated RTMP publish flaw in OSSRS SRS versions below 5.0.213. It allows remote attackers to execute arbitrary code by exploiting misconfigured vhost-level security settings where security.enabled is disabled and no publish authentication is enforced.

Detection Guidance

Use the provided Python proof-of-concept script from the repository to test for unauthenticated RTMP publish access. Run: python3 poc_srs_unauth_publish.py <target_host> <stream_name>. A successful exploit (exit code 0) confirms the vulnerability.

Impact Analysis

An attacker could exploit this to publish unauthorized streams, gain control over the server, or execute malicious code. This may lead to data breaches, service disruption, or further network compromise if the server is part of a larger infrastructure.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face legal penalties, loss of trust, and compliance failures if exploited.

Mitigation Strategies

Upgrade OSSRS SRS to version 5.0.213 or later. Ensure vhost-level security is enabled by setting security.enabled=true and configure proper publish authentication to prevent unauthorized RTMP access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68004. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart