Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Plane community deployments use default secret keys

CVE-2026-105641 · published 6 days ago
Summary

The open‑source Plane tool (versions before 1.4.0) includes deployment files that contain fixed secret keys. If these defaults are not changed, anyone who knows the keys can create forged user sessions or bypass live‑service authentication. Upgrade to version 1.4.0 and replace the default keys with unique, random values for each deployment.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
makeplane plane < 1.4.0
Original advisory text
Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass
Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known SECRET_KEY and LIVE_SERVER_SECRET_KEY defaults that remain active when operators do not override them. The top-level setup.sh randomizes secrets only for the development Docker Compose path, leaving unchanged aio and cli community deployments with shared production secrets. Knowledge of SECRET_KEY enables attackers to forge Django-signed values and compromise accounts or sessions. Knowledge of LIVE_SERVER_SECRET_KEY bypasses live-service authentication on unchanged community deployments. This issue is fixed in 1.4.0.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-798Use of Hard-coded Credentials
Timeline
Published5 Oct 2026
Updated11 Oct 2026
First seen5 Oct 2026
Sources
CVE-2026-105641 · NVD
CVE-2026-105641 · MITRE
CVE-2026-105641 · OSV
GHSA-cmwv-pjmw-8483 · GHSA
Track software like this
Free during beta