Plane: Plaintext logging of API tokens enables privilege escalation
Summary
Plane, an open-source project management tool, logs API keys in plaintext through its API token logging middleware. An attacker with a low-privileged account who can read these logs can steal other users' API keys and use them to escalate privileges. The CVSS 4.0 score is 8.7 (High), and the confidentiality and integrity impact is high.
Affected
- Plane (makeplane) versions prior to 1.4.0
Fixed in
- Upgrade to Plane 1.4.0 or later. The vendor states the issue is fixed in 1.4.0.
Workaround
Unknown.
Exploitation
- CISA SSVC assessment: exploitation none, not automatable, total technical impact.
- No public proof of concept or confirmed in-the-wild exploitation known at the time of writing.
Our recommendation
- Upgrade self-hosted Plane instances to version 1.4.0 or later, preferably the latest stable 1.4.x release.
- Check whether existing logs contain plaintext API keys, restrict or purge them, and rotate API tokens that were active on unpatched instances.
- Review user accounts, including guest accounts, and monitor API token usage for unusual activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-r5p8-cj3q-38cc github.com
- Plane release v1.4.0 github.com
- Plane pull request #9148 github.com
- Plane fix commit edf2475 github.com
- OSV entry CVE-2026-104892 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:36.
Original description (NVD)
Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user API keys and further escalate their privileges. This issue is fixed in 1.4.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.