CVE-2026-104977

Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-27706 and GHSA-jcc6-f9v6-f7jw, an SSRF in work-item link unfurling shipped in v1.2.2, remains incomplete in the v1.3.1 GA release. Any authenticated project member can make the server fetch attacker-selected internal targets, including cloud metadata at 169.254.169.254, and read the response body returned as the link title or favicon. Complete hardening exists on main in PR 9163 but was not included in an earlier released tag. This issue is fixed in 1.4.0.

• CWE-918

• https://github.com/makeplane/plane/commit/04622ce1188c4680951f0001e35efb342fe51615
• https://github.com/makeplane/plane/pull/9163
• https://github.com/makeplane/plane/releases/tag/v1.4.0
• https://github.com/makeplane/plane/security/advisories/GHSA-hhj8-7hv6-m74r
• https://github.com/makeplane/plane/security/advisories/GHSA-hhj8-7hv6-m74r

Published

Oct 5, 2026

Last Modified

Oct 5, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-104970Plane is an open-source project management tool. From 0.13 u…8.1
• CVE-2026-104971Plane is an open-source project management tool. Prior to 1.…8.5
• CVE-2026-104973Plane is an open-source project management tool. Prior to 1.…7.6
• CVE-2026-104974Plane is an open-source project management tool. Prior to 1.…8.1
• CVE-2026-104975Plane is an open-source project management tool. Prior to 1.…7.1
• CVE-2026-104976Plane is an open-source project management tool. Prior to 1.…8.7
• CVE-2026-104978Plane is an open-source project management tool. Prior to 1.…8.2
• CVE-2026-104979Plane is an open-source project management tool. Prior to 1.…8.7
• CVE-2026-104982A flaw has been found in Linux Mint Xreader up to 4.6.5. Thi…4.3
• CVE-2026-104983A vulnerability has been found in Linux Mint Xreader up to 4…6.3
• CVE-2026-104988A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST…8.1
• CVE-2026-104991Phproject before 1.8.7 contains a missing object-level autho…7.1