What’s Vulnerable › Vulnerabilities

CVE-2026-27706: Plane Vulnerable to Full Read SSRF via Favicon Fetching in "Add Link" Feature

• Severity: high (CVSS 7.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-25 · updated 2026-06-17
• Weakness: CWE-918

Description

Plane is an an open-source project management tool. Prior to version 1.2.2, a Full Read Server-Side Request Forgery (SSRF) vulnerability has been identified in the "Add Link" feature. This flaw allows an authenticated attacker with general user privileges to send arbitrary GET requests to the internal network and exfiltrate the full response body. By exploiting this vulnerability, an attacker can steal sensitive data from internal services and cloud metadata endpoints. Version 1.2.2 fixes the issue.

Affected products

• makeplane plane: before 1.2.2 — fixed in 1.2.2

How to fix

Upgrade to a fixed version: makeplane plane 1.2.2. Check the vendor advisory for mitigations.

References

• https://github.com/makeplane/plane/releases/tag/v1.2.2
• https://github.com/makeplane/plane/security/advisories/GHSA-jcc6-f9v6-f7jw

Get alerted when CVE-2026-27706 or the next vulnerability affects your stack