CVE-2026-30242
High · 8.5CVSS
8.5
EPSS
0.3%
Published
Mar 6, 2026
CISA due date
—
The record
Plane is an an open-source project management tool. Prior to version 1.2.3, the webhook URL validation in plane/app/serializers/webhook.py only checks ip.is_loopback, allowing attackers with workspace ADMIN role to create webhooks pointing to private/internal network addresses (10.x.x.x, 172.16.x.x, 192.168.x.x, 169.254.169.254, etc.). When webhook events fire, the server makes requests to these internal addresses and stores the response — enabling SSRF with full response read-back. This issue has been patched in version 1.2.3.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | plane | 0 | 1.2.3 |
Related vulnerabilities
- GHSA-fpx8-73gf-7x73 Plane has SSRF via Incomplete IP Validation in Webhook URL Serializer Same vulnerability
- CVE-2026-30244 Plane is an an open-source project management tool. Also affects plane
- GHSA-87x4-j8vh-p5qf Plane is Vulnerable to Unauthenticated Workspace Member Information Disclosure Also affects plane
- CVE-2026-114730 Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a… CWE-918
- CVE-2026-87953 Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider… CWE-918
- CVE-2026-114634 WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in… CWE-918
- CVE-2026-112288 Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that… CWE-918
- CVE-2026-111936 Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability… CWE-918