{"id":"CVE-2026-104977","published":"2026-10-05T18:17:33.080","lastModified":"2026-10-05T19:17:15.790","description":"Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-27706 and GHSA-jcc6-f9v6-f7jw, an SSRF in work-item link unfurling shipped in v1.2.2, remains incomplete in the v1.3.1 GA release. Any authenticated project member can make the server fetch attacker-selected internal targets, including cloud metadata at 169.254.169.254, and read the response body returned as the link title or favicon. Complete hardening exists on main in PR 9163 but was not included in an earlier released tag. This issue is fixed in 1.4.0.","cvssScore":7.7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://github.com/makeplane/plane/commit/04622ce1188c4680951f0001e35efb342fe51615","tags":[]},{"url":"https://github.com/makeplane/plane/pull/9163","tags":[]},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","tags":[]},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-hhj8-7hv6-m74r","tags":[]},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-hhj8-7hv6-m74r","tags":[]}],"exploitRefs":[{"url":"https://github.com/makeplane/plane/commit/04622ce1188c4680951f0001e35efb342fe51615","tags":[]},{"url":"https://github.com/makeplane/plane/pull/9163","tags":[]},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","tags":[]},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-hhj8-7hv6-m74r","tags":[]},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-hhj8-7hv6-m74r","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw is an incomplete Server-Side Request Forgery (SSRF) vulnerability in Plane's work-item link unfurling feature, where authenticated users can make the server fetch data from internal targets like cloud metadata services. This allows attackers to access sensitive internal resources that should be protected from external access.","exploitability":"Exploitation is relatively straightforward for authenticated project members who can trigger link unfurling, requiring only basic web interaction with a crafted URL to initiate SSRF requests against internal targets.","blast_radius":"The impact could be significant as attackers can access cloud metadata services and potentially extract sensitive credentials or configuration data from internal infrastructure that's normally isolated from external networks.","remediation":"Upgrade to version 1.4.0 which contains the complete fix for this SSRF vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["ssrf","web","auth"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:58:44.964Z"}}