CVE-2026-105628: CWE-918: Server-Side Request Forgery (SSRF) in makeplane plane
Description
Plane, an open-source project management tool, had a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 1.4.0. The issue occurred in the OAuth avatar synchronization flow, where the application fetched avatar URLs from provider user data without validating internal IP addresses and followed redirects by default. This allowed attackers to supply avatar URLs that redirected to internal-only resources, such as metadata endpoints. The fetched content was then uploaded as a user avatar and exposed via a public API endpoint, enabling exfiltration of internal data. The vulnerability is fixed in version 1.4.0.
CVSS v3.1
Score 7.6high
Affected software
makeplane
plane
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-105628 describes an SSRF vulnerability in Plane before version 1.4.0. During OAuth avatar synchronization, Plane fetches the avatar_url from provider user data through a server-side HTTP request without validating whether the target URL is internal or external. The request follows redirects by default, allowing an attacker to supply an avatar URL that redirects to internal-only resources. The response content is uploaded as a user avatar file and exposed via the /api/assets/v2/static/{asset_id}/ endpoint, which can be accessed to exfiltrate the internally fetched content. This vulnerability is addressed in Plane version 1.4.0.
Potential Impact
An attacker with the ability to influence the avatar URL in the OAuth flow can cause the Plane server to make HTTP requests to internal network resources, potentially accessing sensitive internal endpoints such as metadata services. The fetched content is then exposed publicly through an API endpoint, leading to confidentiality breaches of internal data. The vulnerability has a CVSS score of 7.6 (high severity), indicating a significant impact on confidentiality with limited impact on integrity and no impact on availability.
Mitigation Recommendations
This vulnerability is fixed in Plane version 1.4.0. Users should upgrade to version 1.4.0 or later to remediate this issue. No additional mitigations are specified or required once the update is applied.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-05T16:40:39.610Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac3e69c2cdf04f65628b47a
Added to database: 10/05/2026, 18:04:12 UTC
Last enriched: 10/05/2026, 18:19:06 UTC
Last updated: 10/05/2026, 18:56:34 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.