FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes, bypassing -protocol_whitelist, to probe internal network services.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in
    ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location
    URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes, bypassing
    -protocol_whitelist, to probe internal network services. (CVE-2026-107698)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in     ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location     URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes, bypassing
    -protocol_whitelist, to probe internal network services. (CVE-2026-107698)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
476156	Chainguard: ffmpeg-6: security update to 6.1.5-r0	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
476156	Chainguard: ffmpeg-6: security update to 6.1.5-r0	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
365649	Linux Distros Unpatched Vulnerability : CVE-2026-107698	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-107698

medium

Tenable Plugins

medium

medium

medium