CVE Intelligence
Analysis AI-assisted

CVE-2026-105641: Plane: hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY in community deployment manifests (CWE-798)

Plane versions before 1.4.0 ship fixed, publicly known SECRET_KEY and LIVE_SERVER_SECRET_KEY defaults in the aio and cli community deployment manifests, and these stay active when operators do not override them. The record lists a CVSS 3.1 base score of 9.8 (critical). The record states the issue is fixed in 1.4.0, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Plane is an open-source project management tool. According to the record, the aio and cli community deployment manifests before 1.4.0 include fixed, publicly known defaults for SECRET_KEY and LIVE_SERVER_SECRET_KEY. The weakness is classified as CWE-798, Use of Hard-coded Credentials.

Impact

  • Knowledge of SECRET_KEY could let an attacker forge Django-signed values, potentially compromising accounts or sessions.
  • Knowledge of LIVE_SERVER_SECRET_KEY could bypass live-service authentication on unchanged community deployments.
  • The record assigns a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and an SSVC technical impact of total.

Affected products and versions

  • Makeplane Plane in versions prior to 1.4.0, as listed in the affected entry of the record.
  • The exposure is specific to aio and cli community deployments that keep the default secrets. The record states that the setup.sh script randomizes secrets only for the development Docker Compose path.

Exploitation status

The record shows that this CVE is not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted. The SSVC metadata lists exploitation as 'poc', and the EPSS probability is 0.0046 (percentile 0.38152) dated 2026-10-13. These values describe likelihood and proof-of-concept status, not confirmed active exploitation.

Remediation and mitigation

  • Upgrade Plane to 1.4.0 or later, as stated in the record and the release reference.
  • Treat SECRET_KEY and LIVE_SERVER_SECRET_KEY in unchanged aio or cli community deployments as compromised, and replace them with unique, randomly generated values.
  • Consider invalidating existing sessions after the secrets are rotated.
  • Confirm that running configurations no longer contain the default values from the manifests.

Detection guidance

  • Inventory Plane deployments and identify which ones were built from the aio or cli community manifests.
  • Check whether the configured secrets match the publicly documented defaults, without sharing or copying the values.
  • Review authentication and session logs for unexpected activity, keeping in mind that forged sessions may not leave obvious traces.

Limitations of the available information

  • The record does not describe the code change made in 1.4.0 or whether upgrading alone replaces existing secrets.
  • The fixes list in the record is empty, so the fixed version comes from the description and the release reference.
  • The record shows a source status of Deferred.
  • It is unknown whether the affected deployments are exposed to the internet.

Frequently asked questions

Which Plane versions are affected by CVE-2026-105641?

The record lists Makeplane Plane versions prior to 1.4.0 as affected. The exposure concerns aio and cli community deployments that keep the default SECRET_KEY and LIVE_SERVER_SECRET_KEY values.

Is this vulnerability being actively exploited?

The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted. The SSVC metadata records a proof-of-concept exploitation status.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.