CVE-2026-27706
Last modified
CVE-2026-27706 is a high-severity vulnerability rated 7.7/10 on the CVSS scale. Plane is an an open-source project management tool. Prior to version 1.2.2, a Full Read Server-Side Request Forgery (SSRF) vulnerability has been identified in the "Add Link" feature. EPSS estimates a 0.21% chance of exploitation in the next 30 days.
Description
Plane is an an open-source project management tool. Prior to version 1.2.2, a Full Read Server-Side Request Forgery (SSRF) vulnerability has been identified in the "Add Link" feature. This flaw allows an authenticated attacker with general user privileges to send arbitrary GET requests to the internal network and exfiltrate the full response body. By exploiting this vulnerability, an attacker can steal sensitive data from internal services and cloud metadata endpoints. Version 1.2.2 fixes the issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Plane | Plane | < 1.2.2 |
References
- https://github.com/makeplane/plane/releases/tag/v1.2.2Product, Release Notes
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-27706?
How severe is CVE-2026-27706?
How do I fix CVE-2026-27706?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-27700Hono is a Web application framework that provides support fo…7.5
- CVE-2026-27701LiveCode is an open-source, client-side code playground. Pri…8.8
- CVE-2026-27702Budibase is a low code platform for creating internal tools,…9
- CVE-2026-27703RIOT is an open-source microcontroller operating system, des…9.8
- CVE-2026-27704The Dart and Flutter SDKs provide software development kits …7.5
- CVE-2026-27705Plane is an an open-source project management tool. Prior to…6.5
- CVE-2026-27707Seerr is an open-source media request and discovery manager …9.8
- CVE-2026-27708FOSSBilling is a free, open-source billing and client manage…7.1
- CVE-2026-27709NanaZip is an open source file archive. Starting in version …6.6
- CVE-2026-2771Undefined behavior in the DOM: Core & HTML component. This v…9.8
- CVE-2026-27710NanaZip is an open source file archive. Starting in version …5
- CVE-2026-27711NanaZip is an open source file archive. Starting in version …6.6
Are you affected by CVE-2026-27706?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST