CVE-2026-105641

Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known SECRET_KEY and LIVE_SERVER_SECRET_KEY defaults that remain active when operators do not override them. The top-level setup.sh randomizes secrets only for the development Docker Compose path, leaving unchanged aio and cli community deployments with shared production secrets. Knowledge of SECRET_KEY enables attackers to forge Django-signed values and compromise accounts or sessions. Knowledge of LIVE_SERVER_SECRET_KEY bypasses live-service authentication on unchanged community deployments. This issue is fixed in 1.4.0.

• CWE-798

• https://github.com/makeplane/plane/commit/1acc69e816a9a8789032bf711aa9a3c12fcd285c
• https://github.com/makeplane/plane/pull/9291
• https://github.com/makeplane/plane/releases/tag/v1.4.0
• https://github.com/makeplane/plane/security/advisories/GHSA-cmwv-pjmw-8483

Published

Oct 5, 2026

Last Modified

Oct 5, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-105636Plane is an open-source project management tool. Prior to 1.…9.9
• CVE-2026-105637Plane is an open-source project management tool. Prior to 1.…9.6
• CVE-2026-105638Plane is an open-source project management tool. Prior to 1.…9.1
• CVE-2026-105639Plane is an open-source project management tool. Prior to 1.…9.8
• CVE-2026-10564IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side …8.2
• CVE-2026-105640Plane is an open-source project management tool. Prior to 1.…9.1
• CVE-2026-105642Ghost is a Node.js content management system. From 6.56.0 un…8.8
• CVE-2026-105643Ghost is a Node.js content management system. From version 6…7.3
• CVE-2026-105644Ghost is a Node.js content management system. From 4.0.0 unt…6.8
• CVE-2026-105645Ghost is a Node.js content management system. From 5.37.0 un…4.9
• CVE-2026-105646Ghost is a Node.js content management system. From 4.0.0 unt…4.9
• CVE-2026-105647Ghost is a Node.js content management system. From 6.54.1 un…4