Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

Plane allows internal data exposure via webhook redirect

CVE-2026-105636 · published 6 days ago
Summary

The Plane project‑management app lets users set up webhooks. Because the system follows redirects without checking the final address, a malicious webhook can be made to pull information from internal services, such as cloud metadata, and store it where the attacker can later read it. Upgrade to version 1.4.0 or later to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
makeplane plane < 1.4.0
Original advisory text
Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)
Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhook_task.py calls requests.post() without allow_redirects=False and does not validate redirect targets. validate_url() blocks private, loopback, link-local, and reserved addresses in the original webhook URL, but the final URL reached after one or more redirects is not checked. A user who can create a workspace can register a webhook pointing to an attacker-controlled public endpoint that returns a 302 redirect to an internal address. The Plane worker then fetches internal resources, including cloud metadata, and stores the response body in webhook_logs, where the attacker can retrieve it through the workspace webhook-logs API. This issue is fixed in 1.4.0.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.9 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published5 Oct 2026
Updated11 Oct 2026
First seen5 Oct 2026
Sources
CVE-2026-105636 · NVD
CVE-2026-105636 · MITRE
CVE-2026-105636 · OSV
GHSA-mq87-52pf-hm3h · GHSA
Track software like this
Free during beta