Plane: Hard-coded SECRET_KEY and LIVE_SERVER_SECRET_KEY in community deployments
Summary
Plane community deployments (AIO and CLI manifests) shipped with publicly known default values for SECRET_KEY and LIVE_SERVER_SECRET_KEY that stayed active unless the operator overrode them. An unauthenticated remote attacker who knows these values can forge Django-signed values to compromise accounts or sessions, and can bypass authentication of the live server service. The issue affects unchanged community deployments only.
Affected
- Plane versions prior to 1.4.0
- Community AIO and CLI deployments using the default SECRET_KEY or LIVE_SERVER_SECRET_KEY values
Fixed in
- Plane 1.4.0 (removes the default values from the AIO and CLI manifests and generates random keys on first boot)
Workaround
- Set unique, random values for SECRET_KEY and LIVE_SERVER_SECRET_KEY (for example with openssl rand -hex 32)
- Restrict network access to the instance until the keys are changed
- Changing SECRET_KEY signs users out and requires re-entering saved instance settings
Exploitation
- CISA SSVC: exploitation status PoC, automatable: yes, technical impact: total
- CVSS 3.1 base score 9.8 (critical), network attack, no authentication or user interaction required
- No known exploitation in the wild at the time of research; EPSS 0%
Our recommendation
- Inventory all Plane instances and identify whether they were deployed with the AIO or CLI community manifests
- Upgrade to Plane 1.4.0 or later
- Verify that SECRET_KEY and LIVE_SERVER_SECRET_KEY are unique and not the old defaults; rotate them if necessary and expect a forced sign-out
- Check that the upgrade actually replaced the old defaults, as upgrade behaviour is not fully documented
- Restrict public exposure of instances that used the old defaults and review logs for unexpected sessions or live-service access
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-cmwv-pjmw-8483 github.com
- Plane 1.4.0 release github.com
- Fix commit 1acc69e github.com
- Pull request #9291 github.com
- OSV entry CVE-2026-105641 osv.dev
- Rapid7 vulnerability record www.rapid7.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:15.
Original description (NVD)
Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known SECRET_KEY and LIVE_SERVER_SECRET_KEY defaults that remain active when operators do not override them. The top-level setup.sh randomizes secrets only for the development Docker Compose path, leaving unchanged aio and cli community deployments with shared production secrets. Knowledge of SECRET_KEY enables attackers to forge Django-signed values and compromise accounts or sessions. Knowledge of LIVE_SERVER_SECRET_KEY bypasses live-service authentication on unchanged community deployments. This issue is fixed in 1.4.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.