CVE-2026-104977: CWE-918: Server-Side Request Forgery (SSRF) in makeplane plane
Description
Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-27706 and GHSA-jcc6-f9v6-f7jw, an SSRF in work-item link unfurling shipped in v1.2.2, remains incomplete in the v1.3.1 GA release. Any authenticated project member can make the server fetch attacker-selected internal targets, including cloud metadata at 169.254.169.254, and read the response body returned as the link title or favicon. Complete hardening exists on main in PR 9163 but was not included in an earlier released tag. This issue is fixed in 1.4.0.
CVSS v3.1
Score 7.7high
Affected software
makeplane
plane
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-104977 is a Server-Side Request Forgery (SSRF) vulnerability in the Plane project management tool. The flaw exists because prior fixes for SSRF in work-item link unfurling were incomplete in versions before 1.4.0, specifically in the 1.3.1 release. Authenticated project members can exploit this to make the server fetch arbitrary internal targets, such as cloud metadata endpoints at 169.254.169.254, and read the response content as link titles or favicons. The vulnerability is fully addressed in Plane version 1.4.0, where complete hardening was applied.
Potential Impact
An attacker with authenticated access can leverage this SSRF vulnerability to access internal network resources and sensitive metadata, potentially exposing confidential information. The vulnerability does not impact integrity or availability but has a high confidentiality impact. There are no known exploits in the wild at this time.
Mitigation Recommendations
Upgrade Plane to version 1.4.0 or later, where the SSRF vulnerability is fully fixed. Versions prior to 1.4.0 remain vulnerable due to incomplete prior fixes. No other mitigations are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-02T18:16:13.629Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac3e69c2cdf04f65628b47c
Added to database: 10/05/2026, 18:04:12 UTC
Last enriched: 10/05/2026, 18:18:59 UTC
Last updated: 10/05/2026, 19:04:09 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.