CVE-2026-68004: OSSRS SRS Remote Code Execution Vulnerability

CVE-2026-68004 Overview

CVE-2026-68004 is a critical access control vulnerability in OSSRS SRS (Simple Realtime Server) versions prior to v5.0.213. The flaw resides in the RTMP publish authorization logic implemented in SrsSecurity::check() within trunk/src/app/srs_app_security.cpp. A remote unauthenticated attacker can abuse the vhost-level security configuration (security.enabled) and the SRS RTMP listener to execute arbitrary code on the streaming server. The vulnerability is classified under CWE-284: Improper Access Control.

Critical Impact

Remote unauthenticated attackers can bypass RTMP publish authorization on SRS media servers and achieve arbitrary code execution over the network.

Affected Products

• OSSRS SRS (Simple Realtime Server) versions prior to v5.0.213
• SRS deployments using vhost-level security.enabled configuration
• RTMP listener components in SRS v5 branch

Discovery Timeline

• 2026-08-17 - CVE-2026-68004 published to NVD
• 2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-68004

Vulnerability Analysis

SRS is an open-source realtime streaming server that ingests and delivers RTMP, HLS, WebRTC, and SRT media. The vulnerability affects the publish authorization path exercised when an RTMP client attempts to push a stream to a configured vhost. The SrsSecurity::check() function in trunk/src/app/srs_app_security.cpp fails to correctly enforce the intended access control rules defined by the security.enabled directive.

Because the check occurs on the network-facing RTMP listener, exploitation requires no prior authentication and no user interaction. A successful publish leads to arbitrary code execution in the context of the SRS process, giving attackers full control over the streaming pipeline and the underlying host.

Root Cause

The root cause is improper access control ([CWE-284]) inside SrsSecurity::check(). The function does not consistently apply the vhost-level security.enabled policy to inbound RTMP publish requests. Requests that should be denied are treated as authorized, allowing attacker-controlled stream data to reach code paths that execute or process it unsafely.

Attack Vector

Exploitation is fully remote over the RTMP protocol. An attacker crafts an RTMP publish request against a vulnerable SRS instance and bypasses the vhost security policy. Once authorized as a publisher, the attacker leverages the downstream processing to execute arbitrary code on the server. A proof-of-concept is published in the CVE-2026-68004 PoC repository.

No verified exploit code is reproduced here. See the linked PoC and the SRS v5.0-r3 release notes for technical details.

Detection Methods for CVE-2026-68004

Indicators of Compromise

• Unexpected RTMP publish events from unknown source IP addresses on port 1935 or other configured RTMP ports.
• SRS process spawning child processes such as sh, bash, python, or network utilities on media servers where such behavior is not expected.
• New or modified files under the SRS working directory, HLS output paths, or configuration directories.
• Outbound network connections initiated by the SRS process to attacker-controlled infrastructure.

Detection Strategies

• Inspect SRS access logs for publish attempts against vhosts where security.enabled is set but the client IP is outside the allow list.
• Compare the running SRS binary version against v5.0.213 and flag any host on an earlier release.
• Monitor SrsSecurity::check() decision outcomes by enabling verbose SRS logging and alerting on anomalous allow publish results.

Monitoring Recommendations

• Forward SRS logs and host process telemetry into a centralized analytics platform and baseline normal publisher IP ranges.
• Alert on any process descendant of the SRS daemon that is not part of the documented streaming pipeline.
• Track outbound egress from streaming servers, which typically have narrow, predictable network patterns.

How to Mitigate CVE-2026-68004

Immediate Actions Required

• Upgrade all SRS instances to v5.0.213 or later using the artifacts from the SRS v5.0-r3 release.
• Restrict inbound access to RTMP ports (default 1935) to trusted publisher networks using host or network firewalls.
• Audit vhost configurations and ensure security.enabled is set with explicit allow rules for known publishers.

Patch Information

The SRS maintainers addressed the issue in v5.0.213 (release tag v5.0-r3). The fix corrects the authorization logic in SrsSecurity::check() so that vhost-level security.enabled rules are enforced for RTMP publish requests. Operators should redeploy SRS containers or binaries from the official release and validate the version reported by ./objs/srs -v.

Workarounds

• Terminate RTMP ingest behind an authenticating reverse proxy or edge gateway that validates publisher identity before traffic reaches SRS.
• Bind the RTMP listener to an internal management interface and require VPN or bastion access for publishers.
• Disable RTMP publish entirely on vhosts that only need playback until the patched version is deployed.

# Configuration example: restrict RTMP publish to a known publisher subnet
vhost __defaultVhost__ {
    security {
        enabled on;
        rule {
            action allow;
            method publish;
            entry 10.0.10.0/24;
        }
        rule {
            action deny;
            method publish;
            entry all;
        }
    }
}