{"id":"CVE-2026-104973","published":"2026-10-05T18:17:32.290","lastModified":"2026-10-07T21:17:09.833","description":"Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-30242 validates webhook IP addresses only when the webhook is created in apps/api/plane/app/serializers/webhook.py. The delivery task in apps/api/plane/bgtasks/webhook_task.py performs a separate DNS resolution when sending the request and does not validate the resolved IP address, allowing DNS rebinding to bypass the SSRF protection. This issue is fixed in 1.4.0.","cvssScore":7.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N","cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://github.com/makeplane/plane/commit/04622ce1188c4680951f0001e35efb342fe51615","tags":[]},{"url":"https://github.com/makeplane/plane/pull/9163","tags":[]},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","tags":[]},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-whh3-5g95-4qhc","tags":[]},{"url":"https://github.com/cthackers/adm-zip/security/advisories/GHSA-j5f4-cc29-5x44","tags":[]}],"exploitRefs":[{"url":"https://github.com/makeplane/plane/commit/04622ce1188c4680951f0001e35efb342fe51615","tags":[]},{"url":"https://github.com/makeplane/plane/pull/9163","tags":[]},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","tags":[]},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-whh3-5g95-4qhc","tags":[]},{"url":"https://github.com/cthackers/adm-zip/security/advisories/GHSA-j5f4-cc29-5x44","tags":[]}],"hasPoc":true,"ai":{"summary":"The Plane project management tool had a DNS rebinding vulnerability in webhook delivery that allowed attackers to bypass SSRF protections by resolving IP addresses during delivery rather than at creation time. This could enable remote code execution or data exfiltration through manipulated webhooks.","exploitability":"Exploitation requires an attacker to control a DNS server and set up a webhook with a domain name that resolves to an internal IP address, making it moderately difficult but achievable with DNS manipulation capabilities.","blast_radius":"If exploited, this vulnerability could allow attackers to perform SSRF attacks against internal services, potentially leading to unauthorized access to internal systems, data leakage, or further compromise of the Plane application environment.","remediation":"Upgrade to version 1.4.0 or later to receive the fix for CVE-2026-30242 that properly validates IP addresses during webhook delivery.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["ssrf","webhook","dns-rebinding"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:00:01.056Z"}}