External risk intelligence

OSSRS SRS Remote Code Execution via RTMP Publish Authorization

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-68004

OSSRS (Simple Realtime Server) is a media server designed to handle RTMP and other streaming protocols, which are typically deployed as public-facing gateways or endpoints to receive and distribute live video traffic from the internet.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability affects OSSRS SRS, a streaming media server, potentially allowing attackers to execute arbitrary code. The issue stems from how the server handles RTMP publishing and security configurations. Given the nature of media servers as public-facing gateways, understanding if this technology is in use is important for assessing potential exposure.

Remote code execution flaw in streaming server.
Affects public-facing media distribution points.
Confirm if this streaming technology is in use.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerable component through the network by sending specially crafted RTMP publish requests. This bypasses authorization checks and exploits security misconfigurations in the server's host settings, potentially leading to the execution of arbitrary code.

Network access required.
Bypasses RTMP publish authorization.
Enables arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow a remote attacker to execute arbitrary code on systems running OSSRS SRS by manipulating RTMP publish authorization and security configurations. When supported by the advisory, this could affect the confidentiality, integrity, and availability of the server and any data it processes.

Server code execution.
Exploiting RTMP publish authorization.
Unauthorized code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application and platform teams are likely responsible for addressing this vulnerability in OSSRS SRS, given its role as a media server handling external traffic. The first critical step is to identify all instances of the affected technology, confirm its exposure and business criticality, and then assign ownership to the appropriate team for risk-based remediation planning.

Own the issue: Application or Platform Teams.
Verify first: Identify and confirm exposure.
Action to follow: Plan risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OSSRS SRS?

OSSRS SRS (Simple Realtime Server) is an industrial-grade media server built to handle low-latency streaming protocols. It is widely used for live video distribution, serving as a gateway that receives RTMP feeds from broadcasters and transmits them to large audiences across the internet.

How does CVE-2026-68004 create a security risk?

This vulnerability is classified as Improper Access Control (CWE-284). It means the server fails to properly verify permissions during the RTMP publishing process. By manipulating security configurations, an attacker can bypass authorization checks, allowing them to run unauthorized code directly on the server host.

What triggers this vulnerability in the SRS server?

The issue is triggered when the server processes specific, malicious RTMP publish requests that interact with the security check functions. It is important to note that simply running the server does not trigger the flaw; the server must be actively processing RTMP streams where the vulnerable security configurations are enabled.

Is my deployment at risk according to Halo Surface Signal?

Halo Surface Signal indicates this is a high-priority concern because SRS is typically deployed as a public-facing gateway to receive live video traffic. If your server is reachable from the internet to accept external video feeds, it has the network exposure required for an attacker to attempt this exploit.

What should I do to secure my SRS implementation?

Your first step is to audit your environment to locate all running instances of SRS and verify their version numbers. Once identified, work with your engineering team to plan an upgrade to a version beyond 5.0.213, where these authorization and security checks are properly enforced.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.