{"id":"CVE-2026-105636","published":"2026-10-05T19:17:17.693","lastModified":"2026-10-07T22:17:02.053","description":"Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhook_task.py calls requests.post() without allow_redirects=False and does not validate redirect targets. validate_url() blocks private, loopback, link-local, and reserved addresses in the original webhook URL, but the final URL reached after one or more redirects is not checked. A user who can create a workspace can register a webhook pointing to an attacker-controlled public endpoint that returns a 302 redirect to an internal address. The Plane worker then fetches internal resources, including cloud metadata, and stores the response body in webhook_logs, where the attacker can retrieve it through the workspace webhook-logs API. This issue is fixed in 1.4.0.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://github.com/makeplane/plane/commit/04622ce1188c4680951f0001e35efb342fe51615","tags":[]},{"url":"https://github.com/makeplane/plane/pull/9163","tags":[]},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","tags":[]},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-mq87-52pf-hm3h","tags":[]},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-mq87-52pf-hm3h","tags":[]}],"exploitRefs":[{"url":"https://github.com/makeplane/plane/commit/04622ce1188c4680951f0001e35efb342fe51615","tags":[]},{"url":"https://github.com/makeplane/plane/pull/9163","tags":[]},{"url":"https://github.com/makeplane/plane/releases/tag/v1.4.0","tags":[]},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-mq87-52pf-hm3h","tags":[]},{"url":"https://github.com/makeplane/plane/security/advisories/GHSA-mq87-52pf-hm3h","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows an attacker to exploit a webhook to fetch internal resources by registering a malicious URL that redirects to an internal address, leading to potential data exfiltration.","exploitability":"Exploitation is moderately hard as it requires the attacker to control a public endpoint and the ability to create a workspace. Precondition is the existence of a vulnerable Plane version prior to 1.4.0.","blast_radius":"If exploited, the attacker can retrieve sensitive internal data, impacting the confidentiality of the organization’s resources.","remediation":"Upgrade to Plane version 1.4.0 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["web","data-exfiltration","internal-resource-fetch"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-06T08:44:19.747Z"}}