CVE-2026-30242: Plane Project Management Tool SSRF Flaw

CVE-2026-30242 Overview

CVE-2026-30242 is a Server-Side Request Forgery (SSRF) vulnerability in Plane, an open-source project management tool. The vulnerability exists in the webhook URL validation logic within plane/app/serializers/webhook.py, which only checks for loopback addresses using ip.is_loopback. This insufficient validation allows attackers with workspace ADMIN role to create webhooks pointing to private and internal network addresses, including 10.x.x.x, 172.16.x.x, 192.168.x.x, and the AWS metadata endpoint 169.254.169.254. When webhook events fire, the server makes HTTP requests to these internal addresses and stores the full response, enabling SSRF with complete response read-back capabilities.

Critical Impact
Authenticated attackers with workspace ADMIN privileges can exploit this SSRF vulnerability to access internal network resources, cloud instance metadata, and sensitive services not intended to be externally accessible.

Affected Products

Plane versions prior to 1.2.3

Discovery Timeline

2026-03-06 - CVE-2026-30242 published to NVD
2026-03-10 - Last updated in NVD database

Technical Details for CVE-2026-30242

Vulnerability Analysis

This SSRF vulnerability (CWE-918) stems from incomplete IP address validation in the webhook functionality. The webhook serializer in Plane only validates against loopback addresses (127.0.0.1, ::1), failing to account for RFC 1918 private network ranges and link-local addresses commonly used in cloud environments for metadata services.

When a user with workspace ADMIN privileges configures a webhook, they can specify a target URL pointing to internal network resources. The application then makes server-side HTTP requests to these URLs when webhook events are triggered, and critically, returns the full response content to the attacker. This creates a powerful SSRF primitive that enables reconnaissance and data exfiltration from internal infrastructure.

The vulnerability is particularly dangerous in cloud-hosted deployments where access to instance metadata services (such as 169.254.169.254 in AWS) can expose IAM credentials, API tokens, and other sensitive configuration data.

Root Cause

The root cause is insufficient URL validation in the plane/app/serializers/webhook.py file. The validation logic relies solely on Python's ip.is_loopback property to block internal addresses. This check fails to account for:

Private IPv4 ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
Link-local addresses: 169.254.0.0/16 (including cloud metadata endpoints)
IPv6 unique local addresses: fc00::/7
Other non-routable address spaces

Attack Vector

An attacker with workspace ADMIN privileges in Plane can exploit this vulnerability through the following attack flow:

Authenticate to Plane with workspace ADMIN credentials
Create a new webhook configuration targeting an internal IP address (e.g., http://169.254.169.254/latest/meta-data/)
Trigger a webhook event (such as creating or updating a project issue)
The server makes an HTTP request to the attacker-specified internal URL
The server stores and returns the full response content
The attacker retrieves the response containing sensitive internal data

The vulnerability requires low-privilege authentication (workspace ADMIN role) but can result in access to highly sensitive internal resources and potential lateral movement within cloud or corporate networks.

Detection Methods for CVE-2026-30242

Indicators of Compromise

Webhook configurations targeting private IP ranges (10.x.x.x, 172.16.x.x, 192.168.x.x)
Webhook URLs pointing to cloud metadata endpoints (169.254.169.254)
Unusual outbound HTTP connections from the Plane server to internal network addresses
Webhook configurations with non-standard ports targeting internal services

Detection Strategies

Monitor webhook configuration changes for URLs containing private IP addresses or metadata service endpoints
Implement network-level monitoring for outbound connections from application servers to internal IP ranges
Review webhook audit logs for suspicious URL patterns or high-frequency access attempts
Deploy web application firewall rules to detect SSRF patterns in webhook URL parameters

Monitoring Recommendations

Enable comprehensive logging for all webhook creation and modification events
Configure alerting on network connections to RFC 1918 address ranges from the Plane application tier
Monitor for access patterns consistent with metadata service enumeration (sequential requests to 169.254.169.254)
Implement egress filtering and logging at the network perimeter

How to Mitigate CVE-2026-30242

Immediate Actions Required

Upgrade Plane to version 1.2.3 or later immediately
Audit existing webhook configurations for URLs targeting internal IP addresses
Review webhook activity logs for evidence of exploitation
Implement network-level egress controls to restrict Plane server access to internal resources

Patch Information

The vulnerability has been patched in Plane version 1.2.3. The patch enhances webhook URL validation to block all private and non-routable IP address ranges, not just loopback addresses. Organizations should upgrade to the patched version as soon as possible.

For detailed patch information, see the GitHub Release v1.2.3 and the GitHub Security Advisory GHSA-fpx8-73gf-7x73.

Workarounds

Implement network-level egress filtering to prevent the Plane server from making HTTP connections to private IP ranges and cloud metadata endpoints
Deploy a web application firewall with SSRF protection rules in front of the Plane application
Restrict webhook creation permissions to trusted administrators only
Use network segmentation to isolate the Plane application from sensitive internal services

bash

# Example iptables rules to block SSRF to private networks from Plane server
# Block connections to private IPv4 ranges
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner www-data -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner www-data -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner www-data -j DROP
iptables -A OUTPUT -d 169.254.0.0/16 -m owner --uid-owner www-data -j DROP