CVE-2026-105636: CWE-918: Server-Side Request Forgery (SSRF) in makeplane plane

Plane versions prior to 1.4.0 contain an SSRF vulnerability (CWE-918) in the webhook delivery task located in apps/api/plane/bgtasks/webhook_task.py. The code calls requests.post() without setting allow_redirects=False and does not validate the final URL after redirects. Although validate_url() blocks private, loopback, link-local, and reserved addresses in the original webhook URL, it does not check the final redirect target. An attacker with workspace creation privileges can register a webhook pointing to an attacker-controlled endpoint that issues a 302 redirect to an internal address. The Plane worker then fetches internal resources, including cloud metadata, and stores the response body in webhook_logs, which the attacker can retrieve via the workspace webhook-logs API. The vulnerability is resolved in version 1.4.0.

An attacker with the ability to create a workspace can exploit this SSRF vulnerability to make the Plane worker fetch internal network resources, including sensitive cloud metadata. The fetched data is logged and accessible to the attacker, potentially leading to disclosure of sensitive internal information. The vulnerability has a CVSS 3.1 score of 9.9 (critical), indicating high impact on confidentiality, integrity, and availability.

This vulnerability is fixed in Plane version 1.4.0. Users should upgrade to version 1.4.0 or later to remediate this issue. No additional mitigations are specified in the advisory. Patch status is confirmed by the vendor advisory stating the fix is in 1.4.0.