Read the docs
TI-2026-22082 Aliases CVE-2026-27706

Plane Vulnerable to Full Read SSRF via Favicon Fetching in "Add Link" Feature

Priority LOW 33CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

Plane is an an open-source project management tool. Prior to version 1.2.2, a Full Read Server-Side Request Forgery (SSRF) vulnerability has been identified in the "Add Link" feature. This flaw allows an authenticated attacker with general user privileges to send arbitrary GET requests to the internal network and exfiltrate the full response body. By exploiting this vulnerability, an attacker can steal sensitive data from internal services and cloud metadata endpoints. Version 1.2.2 fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00242 15th percentileScored 2026-11-07
Fix Fixed plane (makeplane): 1.2.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
makeplaneplanebefore 1.2.21.2.2Patch availableCNA
  • plane Vendormakeplane Affected before 1.2.2 Fixed in 1.2.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:plane:plane:*:*:*:*:*:*:*:*before 1.2.2Vulnerablemakeplane
  • cpe:2.3:a:plane:plane:*:*:*:*:*:*:*:* Versions before 1.2.2 Vulnerable ·makeplane

Remediation

  • Fix · CNA plane (makeplane) Fixed in 1.2.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27706

References

Advisory 1

Other 1

  • TI-2024-32097 Plane allows server side request forgery via /_next/image endpoint CVSS 3.1CRITICAL 9.3
  • TI-2026-34237 Authorization bypass in makeplane plane CVSS 3.1HIGH 8.3
  • TI-2023-02127 Plane v0.7.1 - Unauthorized access to files CVSS 3.1HIGH 7.5
  • TI-2026-28725 Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching CVSS 3.1HIGH 7.7
  • TI-2026-28361 Plane IDOR: Cross-Project Issue Date Modification via Bulk Update Endpoint CVSS 3.1HIGH 7.7
  • TI-2023-14603 Plane 0.7.1 - Insecure file upload CVSS 3.1HIGH 7.1
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences