Plane Server-Side Request Forgery (SSRF) Vulnerability
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Plane, an open-source project management tool, has a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 0.17-dev. This issue may allow an attacker to send arbitrary requests from the server hosting the application, potentially leading to unauthorized access to internal systems. The impact of this vulnerability includes, but is not limited to, unauthorized access to internal services accessible from the server, potential leakage of sensitive information from internal services, manipulation of internal systems by interacting with internal APIs. Version 0.17-dev contains a patch for this issue. Those who are unable to update immediately may mitigate the issue by restricting outgoing network connections from servers hosting the application to essential services only and/or implementing strict input validation on URLs or parameters that are used to generate server-side requests.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| makeplane | plane | before 0.17-dev | 0.17-dev | Patch available | CNA |
- plane Vendormakeplane Affected before 0.17-dev Fixed in 0.17-dev Patch available CNA
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:makeplane:plane:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:makeplane:plane:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
- Fix · CNA plane (makeplane) Fixed in 0.17-dev
Timeline
- 2026-10-02 Threatist record created from CVE-2024-31461
References
Other 6
- https://github.com/makeplane/plane/security/advisories/GHSA-j77v-w36v-63v6
- https://github.com/makeplane/plane/pull/3323
- https://github.com/makeplane/plane/pull/3333
- https://github.com/makeplane/plane/commit/4b0ccea1461b7ca38761dfe0d0f07c2f94425005
- https://github.com/makeplane/plane/commit/d887b780aea5efba3f3d28c47d7d83f8b3e1e21c
- https://securitylab.github.com/advisories/GHSL-2023-257_makeplane_plane
More makeplane vulnerabilities
- TI-2026-67866 Hardcoded secret keys in Plane community deployments CVSS 3.1CRITICAL 9.8
- TI-2026-67865 Account takeover in Plane via unverified OAuth email matching CVSS 3.1CRITICAL 9.1
- TI-2026-67863 Plane magic-code login lacks rate limiting, allowing OTP brute force CVSS 3.1CRITICAL 9.1
- TI-2024-32097 Plane allows server side request forgery via /_next/image endpoint CVSS 3.1CRITICAL 9.3
- TI-2026-67862 Cross-project asset hijacking in Plane allows file takeover CVSS 3.1CRITICAL 9.6
- TI-2026-67861 Server-side request forgery in Plane webhook delivery via redirects CVSS 3.1CRITICAL 9.9
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences