CVE-2026-104977

HIGH 7.7

Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (CGNAT/multicast) + DNS-rebinding TOCTOU

CVSS Score

7.7

EPSS Score

0.0%

EPSS Percentile

0th

Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-27706 and GHSA-jcc6-f9v6-f7jw, an SSRF in work-item link unfurling shipped in v1.2.2, remains incomplete in the v1.3.1 GA release. Any authenticated project member can make the server fetch attacker-selected internal targets, including cloud metadata at 169.254.169.254, and read the response body returned as the link title or favicon. Complete hardening exists on main in PR 9163 but was not included in an earlier released tag. This issue is fixed in 1.4.0.

CWE	CWE-918
Vendor	makeplane
Product	plane
Published	Oct 5, 2026
Last Updated	Oct 5, 2026

Stay Ahead of the Next One

Get instant alerts for makeplane plane

Be the first to know when new high vulnerabilities affecting makeplane plane are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

makeplane / plane

< 1.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/makeplane/plane/security/advisories/GHSA-hhj8-7hv6-m74r github.com: https://github.com/makeplane/plane/pull/9163 github.com: https://github.com/makeplane/plane/commit/04622ce1188c4680951f0001e35efb342fe51615 github.com: https://github.com/makeplane/plane/releases/tag/v1.4.0