CVE-2026-104977: Plane Project Management Tool SSRF Vulnerability

CVE-2026-104977 Overview

CVE-2026-104977 is a Server-Side Request Forgery (SSRF) vulnerability in Plane, an open-source project management tool. The flaw affects versions prior to 1.4.0 and represents an incomplete fix for the earlier CVE-2026-27706 and GHSA-jcc6-f9v6-f7jw advisories. Any authenticated project member can coerce the Plane server into fetching attacker-chosen internal targets through the work-item link unfurling feature. The returned response body is reflected back as the link title or favicon, enabling data exfiltration from internal services and cloud metadata endpoints such as 169.254.169.254.

Critical Impact
Authenticated attackers can read cloud instance metadata and internal network resources, exposing IAM credentials, service tokens, and private infrastructure data.

Affected Products

Plane versions prior to 1.4.0
Plane v1.2.2 (initial incomplete fix for CVE-2026-27706)
Plane v1.3.1 GA release

Discovery Timeline

2026-10-05 - CVE-2026-104977 published to NVD
2026-10-05 - Last updated in NVD database

Technical Details for CVE-2026-104977

Vulnerability Analysis

The vulnerability resides in Plane's work-item link unfurling feature, which fetches external URLs supplied by users to extract metadata such as page titles and favicons. The fix shipped in v1.2.2 and carried into v1.3.1 failed to adequately restrict destination targets. An authenticated project member can supply a URL pointing to internal IP ranges, loopback addresses, or cloud metadata services. The server performs the HTTP request without proper allowlisting, then returns the fetched response body as link preview content visible in the application UI.

This class of flaw is tracked as [CWE-918: Server-Side Request Forgery (SSRF)]. The complete hardening existed on the main branch in PR 9163 but was not backported to the v1.3.1 release tag.

Root Cause

The root cause is insufficient URL validation in the link unfurling and avatar/webhook fetch paths. The pre-patch code used the standard requests library directly, with no pinning of resolved IP addresses, no redirect validation, and no blocklist for private address space including 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and the link-local 169.254.169.254 metadata endpoint used by AWS, Azure, and GCP.

Attack Vector

An authenticated project member creates or edits a work item and inserts a link pointing to an internal target. The Plane backend fetches the URL to unfurl metadata, then stores and returns the response as the link title or favicon. The attacker reads this reflected content from the work item, extracting cloud instance credentials or internal service responses.

python

# Patch excerpt from apps/api/plane/authentication/adapter/base.py
 import uuid
 from io import BytesIO

-import requests
 from django.conf import settings
 from django.core.exceptions import ValidationError
 from django.core.validators import validate_email
+from plane.utils.url_security import pinned_fetch_following_redirects

 # Django imports
 from django.utils import timezone

Source: GitHub Commit 04622ce1

The patch replaces direct requests usage with a hardened pinned_fetch_following_redirects helper that pins resolved IPs and validates each redirect hop against the SSRF blocklist.

Detection Methods for CVE-2026-104977

Indicators of Compromise

Outbound HTTP requests from the Plane application server to 169.254.169.254 or private RFC1918 address ranges originating from the link unfurling worker.
Work items containing URLs pointing to internal hostnames, loopback addresses, or cloud metadata endpoints.
Unexpected link preview titles containing JSON structures, IAM role names, or security credentials.
Elevated outbound DNS lookups for internal zones from the Plane backend.

Detection Strategies

Instrument the Plane backend egress with network policy logging and alert on connections to link-local and private address ranges from the unfurling service.
Query application logs for link unfurling requests whose destination hostname resolves to internal address space.
Audit work-item link metadata in the database for titles or favicon payloads that resemble instance metadata responses.

Monitoring Recommendations

Enforce IMDSv2 on AWS instances hosting Plane to require session tokens for metadata access.
Capture egress NetFlow or VPC Flow Logs from the Plane application tier and baseline normal destinations.
Review audit logs for creation and edit activity on work items that include external links shortly before anomalous backend egress.

How to Mitigate CVE-2026-104977

Immediate Actions Required

Upgrade Plane to version 1.4.0 or later, which includes the complete SSRF hardening from PR 9163.
Enforce IMDSv2 on all cloud instances hosting Plane and restrict the metadata endpoint via host firewall rules.
Revoke and rotate any IAM credentials, OAuth tokens, or webhook secrets accessible from the Plane host, assuming exposure.
Restrict Plane backend egress to only the external domains required for integrations.

Patch Information

The fix is included in Plane v1.4.0. The hardening introduces a new pinned_fetch_following_redirects utility that enforces IP pinning and redirect validation. Technical details are available in GitHub Security Advisory GHSA-hhj8-7hv6-m74r and GitHub Pull Request #9163.

Workarounds

Place the Plane application behind an egress proxy configured to block requests to RFC1918 ranges and 169.254.169.254.
Deploy network ACLs or security groups that deny outbound traffic from the Plane subnet to internal management networks.
Temporarily disable the link unfurling feature or limit project membership to trusted users until the upgrade is applied.

bash

# Example iptables rule blocking cloud metadata access from the Plane container
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT