CVE Intelligence
Analysis AI-assisted

CVE-2026-105636: Plane: SSRF via unvalidated HTTP redirects in webhook delivery

Plane versions before 1.4.0 follow HTTP redirects when delivering workspace webhooks and do not check the final destination, which enables server-side request forgery (SSRF). The record rates it critical with a CVSS 3.1 score of 9.9 and states the issue is fixed in 1.4.0. No CISA KEV listing and no confirmed exploitation appear in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Plane is an open-source project management application. The record describes a server-side request forgery weakness in its webhook delivery task. The task sends HTTP POST requests to user-configured webhook URLs and follows redirects without validating where they lead. The URL supplied when the webhook is created is checked against private, loopback, link-local and reserved address ranges, but the check is not repeated on the final destination after redirects. The advisory states that the issue is fixed in version 1.4.0.

Impact

  • According to the record, a user with the ability to create a workspace can cause the Plane worker to send requests to internal addresses.
  • The record states that response bodies from those requests are stored in webhook logs, which the workspace owner can read through the webhook logs API. This may expose internal resources, including cloud instance metadata.
  • The CVSS 3.1 vector in the record lists high confidentiality, integrity and availability impact with a scope change, and the score is 9.9.
  • The CWE classification is CWE-918, Server-Side Request Forgery.

Affected products and versions

  • Product: Makeplane Plane.
  • Affected range in the record: versions before 1.4.0.
  • Fixed version according to the description and advisory references: 1.4.0.
  • The record's fixes field is empty, so the fixed version is taken from the description and the linked release and advisory pages rather than from a structured fixes entry.

Exploitation status

  • The CISA Known Exploited Vulnerabilities catalog does not list this CVE in the record.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • The SSVC data in the record gives an exploitation value of proof of concept and an automatable value of no, which suggests that public proof-of-concept work may exist but that the issue is not automatable according to that assessment.

Remediation and mitigation

  • Upgrade Plane to version 1.4.0 or later, as indicated by the release and advisory references.
  • Until the upgrade is applied, review which users can create workspaces and register webhooks, and limit those permissions to trusted accounts.
  • Review existing webhook configurations for destinations that are not expected by the organization.
  • Restrict outbound network access from the Plane worker to internal ranges and cloud metadata addresses at the network level, so that a worker cannot reach sensitive internal services even if an application check is bypassed. This is a defence-in-depth measure and does not replace the upgrade.

Detection guidance

  • Review webhook configuration records for destinations that point to unexpected hosts or that were created by unfamiliar accounts.
  • Monitor outbound connections from the Plane worker for traffic to private address ranges, loopback addresses and cloud metadata endpoints.
  • Review webhook delivery logs for unusual response content or for large response bodies returned from webhook targets.
  • Keep application and reverse proxy logs for workspace creation and webhook management actions to support investigation.

Limitations of the available information

  • The record does not describe the full set of affected deployment configurations.
  • The record does not include a structured fixes entry; the 1.4.0 fix comes from the description and the linked references.
  • Only the sources listed in the record were consulted. No independent testing was performed.
  • The EPSS probability is 0.0035 with a percentile of 0.26736 as of the date in the record, which indicates a low modelled likelihood of exploitation within the scoring window.
  • The record's source status is Deferred, so further updates to the entry may follow.

Frequently asked questions

Which Plane versions are affected by this SSRF issue?

The record lists Makeplane Plane versions before 1.4.0 as affected, and states that the issue is fixed in 1.4.0.

Is this vulnerability known to be actively exploited?

The CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation in the wild appears in the sources consulted. The SSVC data indicates a proof-of-concept exploitation level.

What is the main remediation step?

Upgrade Plane to version 1.4.0 or later. Until then, restrict who can create workspaces and register webhooks, and limit outbound network access from the worker to internal ranges.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.