CVE-2026-105628: Plane Project Management SSRF Vulnerability

CVE-2026-105628 Overview

CVE-2026-105628 is a Server-Side Request Forgery (SSRF) vulnerability in Plane, an open-source project management platform. Versions prior to 1.4.0 fetch the avatar_url returned by OAuth providers through a server-side HTTP request without validating internal IP addresses and follow HTTP redirects by default. An attacker who supplies an avatar URL that redirects to an internal resource, such as a cloud metadata endpoint, causes Plane to download the response and store it as a user avatar. The stored object is then served through /api/assets/v2/static/{asset_id}/, exposing internal data to the attacker. The issue is tracked as [CWE-918] and fixed in Plane 1.4.0.

Critical Impact
Authenticated attackers can exfiltrate internal network content, including cloud instance metadata credentials, by abusing the OAuth avatar synchronization flow.

Affected Products

Plane (makeplane/plane) versions prior to 1.4.0
Self-hosted Plane deployments with OAuth avatar synchronization enabled
Cloud-hosted Plane instances running vulnerable releases

Discovery Timeline

2026-10-05 - CVE-2026-105628 published to NVD
2026-10-05 - Last updated in NVD database

Technical Details for CVE-2026-105628

Vulnerability Analysis

The flaw resides in Plane's authentication adapter at apps/api/plane/authentication/adapter/base.py. During OAuth login, the server reads the avatar_url field from provider user data and issues a direct HTTP request using the requests library. The call does not restrict destination IP ranges and allows automatic redirect following. An attacker-controlled OAuth response pointing to an internal URL causes the backend to retrieve that content and persist it as a user avatar asset.

Because the retrieved file is then served through /api/assets/v2/static/{asset_id}/, the attacker can download the stored response and read internal data. This classic SSRF pattern becomes high-impact in cloud environments where metadata services such as http://169.254.169.254/ expose instance credentials, tokens, and configuration.

Root Cause

The adapter lacked IP allow-list enforcement and permitted the HTTP client to transparently follow 3xx redirects. The server trusted an externally supplied URL and treated the fetched bytes as a safe image upload without origin validation.

Attack Vector

An attacker configures or controls an OAuth provider identity whose profile returns an avatar_url such as https://attacker.example/redirect. That endpoint issues a 302 redirect to an internal target, for example a cloud metadata service or an internal admin API. Plane follows the redirect, stores the response as an avatar asset, and exposes it via the static asset endpoint for retrieval.

python

# Patch excerpt: apps/api/plane/authentication/adapter/base.py
 import uuid
 from io import BytesIO
 
-import requests
 from django.conf import settings
 from django.core.exceptions import ValidationError
 from django.core.validators import validate_email
+from plane.utils.url_security import pinned_fetch_following_redirects
 
 # Django imports
 from django.utils import timezone

Source: GitHub Commit 04622ce

The fix replaces the direct requests import with pinned_fetch_following_redirects, a hardened helper that validates each hop against an internal IP block list before performing the request.

Detection Methods for CVE-2026-105628

Indicators of Compromise

Outbound HTTP requests from the Plane application server to RFC1918, link-local (169.254.0.0/16), or loopback addresses originating from the OAuth flow.
Avatar assets in /api/assets/v2/static/ whose content is non-image data such as JSON tokens or HTML from internal services.
OAuth logins where the provider avatar_url points to unexpected or newly-registered external domains.

Detection Strategies

Review application logs for requests.get calls against the avatar fetch path and correlate destination hostnames with internal subnets.
Alert on 3xx responses retrieved during OAuth avatar synchronization followed by requests to private address space.
Inspect stored avatar MIME types and flag non-image content types persisted as user assets.

Monitoring Recommendations

Enforce egress firewall logging on the Plane backend and alert on traffic to cloud metadata endpoints such as 169.254.169.254.
Monitor new OAuth account registrations correlated with downloads of static asset IDs shortly after login.
Baseline avatar file sizes and formats; flag outliers that deviate from standard image signatures.

How to Mitigate CVE-2026-105628

Immediate Actions Required

Upgrade Plane to version 1.4.0 or later, where the OAuth avatar fetch uses pinned_fetch_following_redirects with internal IP validation.
Audit existing avatar assets for non-image payloads and purge any stored responses sourced from internal targets.
Rotate any cloud instance credentials or tokens that may have been reachable from the Plane backend's egress path.

Patch Information

The fix is published in Plane Release v1.4.0 and merged via Pull Request #9163. The hardening commit is tracked in GitHub Commit 04622ce. See the GitHub Security Advisory GHSA-cv9p-325g-wmv5 for the full disclosure.

Workarounds

Block outbound traffic from the Plane application server to private IP ranges and cloud metadata endpoints using host or network firewalls.
Require IMDSv2 on AWS instances to prevent trivial metadata retrieval from redirect-based SSRF.
Disable OAuth avatar synchronization or restrict permitted OAuth providers until the upgrade is completed.

bash

# Example egress restriction using iptables on the Plane host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 80 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 443 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -p tcp --dport 80 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -p tcp --dport 80 -j REJECT