PT-2026-21942 · Plane · Plane

Teppay · Published 2026-02-25 · Updated 2026-02-28 · CVE-2026-27706

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.2.2

Description A Server-Side Request Forgery (SSRF) flaw exists in the "Add Link" feature of Plane, allowing an authenticated attacker with general user privileges to send arbitrary GET requests to the internal network and retrieve the full response body. This can lead to the theft of sensitive data from internal services and cloud metadata endpoints.

Recommendations Update to version 1.2.2 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-27706

GHSA-JCC6-F9V6-F7JW

Affected Products

Plane

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27706.json · Exploit
• https://github.com/makeplane/plane/security/advisories/GHSA-jcc6-f9v6-f7jw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27706 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27706 · Security Note
• https://github.com/makeplane/plane/releases/tag/v1.2.2 · Note
• https://twitter.com/VulmonFeeds/status/2026763088871977466 · Twitter Post
• https://t.me/CVEtracker/45734 · Telegram Post
• https://t.me/cveNotify/153550 · Telegram Post
• https://twitter.com/CVEnew/status/2027744276038181155 · Twitter Post