CVE-2026-105636: Plane: Server-Side Request Forgery via HTTP redirect in webhook delivery

Summary

Plane, an open-source project management tool, does not check redirect targets when delivering webhooks. An authenticated user who can create a workspace can register a webhook to a public endpoint that redirects to an internal address, causing the Plane worker to fetch internal resources such as cloud metadata. The response body is stored in the webhook logs, which the attacker can read through the workspace webhook-logs API.

Affected

Plane versions before 1.4.0
Self-hosted and vendor-cloud deployments are both in scope for the vendor; self-hosted instances must be checked by the operator

Fixed in

Fixed in Plane 1.4.0 (fix commit 04622ce1188c4680951f0001e35efb342fe51615, PR #9163)
Later releases such as 1.4.3 also contain further security fixes

Workaround

Unknown.

Restrict who can create workspaces and webhooks until the upgrade is complete
Block outbound traffic from the Plane worker to cloud metadata endpoints and internal networks

Exploitation

CISA SSVC: exploitation status 'poc', automatable 'no', technical impact 'total'
No public proof of concept or in-the-wild exploitation found at the time of research
KEV listing: not found

Our recommendation

Upgrade all self-hosted Plane instances to 1.4.0 or later, preferably the latest patch release
Restrict workspace creation to trusted users until patched
Enforce IMDSv2 or equivalent on cloud VMs hosting Plane
Review webhook logs for unexpected internal responses and check for access to metadata endpoints

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Plane 1.4.0 release github.com
Fix commit 04622ce github.com
Pull request #9163 github.com
GitHub Security Advisory GHSA-mq87-52pf-hm3h github.com
OSV entry CVE-2026-105636 osv.dev

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:43.

Original description (NVD)

Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhook_task.py calls requests.post() without allow_redirects=False and does not validate redirect targets. validate_url() blocks private, loopback, link-local, and reserved addresses in the original webhook URL, but the final URL reached after one or more redirects is not checked. A user who can create a workspace can register a webhook pointing to an attacker-controlled public endpoint that returns a 302 redirect to an internal address. The Plane worker then fetches internal resources, including cloud metadata, and stores the response body in webhook_logs, where the attacker can retrieve it through the workspace webhook-logs API. This issue is fixed in 1.4.0.

NVD references (5)

Sources

The tracker combines official, freely usable data sources – updated continuously:

NVD (NIST) – CVEs, rating (CVSS), affected products
CISA KEV – vulnerabilities confirmed by CISA as actively exploited
CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
FIRST EPSS – probability of exploitation
Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
PoC-in-GitHub – public proof-of-concept repositories
Metasploit (Rapid7) – modules of the Metasploit Framework
Exploit-DB (OffSec) – archive of public exploits (links only)
Patch days: official vendor pages (linked per vendor) (Vendor patch days)

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touch RSS feed