PT-2026-23618 · Plane · Plane

Byamb4 · Published 2026-03-05 · Updated 2026-03-10 · CVE-2026-30242

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.2.3

Description The webhook URL validation in plane/app/serializers/webhook.py only checks if the IP address is loopback, allowing attackers with workspace ADMIN role to create webhooks pointing to private or internal network addresses such as 10.x.x.x, 172.16.x.x, 192.168.x.x, and 169.254.169.254. When webhook events are triggered, the server sends requests to these internal addresses and stores the response, enabling Server-Side Request Forgery (SSRF) with full response read-back. This can lead to cloud metadata exfiltration, internal service scanning, and data exfiltration via response logs.

Recommendations Versions prior to 1.2.3 should be updated to version 1.2.3 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-30242

GHSA-FPX8-73GF-7X73

Affected Products

Plane

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30242.json · Exploit
• https://github.com/makeplane/plane/security/advisories/GHSA-fpx8-73gf-7x73 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30242 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fpx8-73gf-7x73 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30242 · Security Note
• https://github.com/makeplane/plane/releases/tag/v1.2.3 · Note
• https://github.com/makeplane/plane · Note
• https://t.me/cveNotify/154926 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1rmd0qe/resumen_diario_de_vulnerabilidades_06032026 · Reddit Post
• https://t.me/CVEtracker/46664 · Telegram Post
• https://twitter.com/TheHackerWire/status/2030208085281972269 · Twitter Post
• https://twitter.com/CVEnew/status/2030385148550648130 · Twitter Post