CVE-2026-39843: Plane Project Management SSRF Vulnerability

CVE-2026-39843 Overview

CVE-2026-39843 is a Server-Side Request Forgery (SSRF) vulnerability affecting Plane, an open-source project management tool. This vulnerability exists due to an incomplete remediation of a previous security issue (GHSA-jcc6-f9v6-f7jw), allowing authenticated attackers with low privileges to perform full read SSRF attacks by exploiting the favicon fetching mechanism. When a user supplies a link containing an HTML page with a link tag that redirects to a private IP address via the "Add link" feature, the application fails to properly validate redirects during favicon retrieval, potentially exposing internal network resources.

Critical Impact

Authenticated attackers can access internal network resources and sensitive data through SSRF by exploiting insufficient redirect validation in the favicon fetch functionality.

Affected Products

• Plane versions 0.28.0 through 1.2.x
• Plane installations with "Add link" functionality enabled
• Self-hosted Plane deployments with access to internal network resources

Discovery Timeline

• 2026-04-09 - CVE CVE-2026-39843 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-39843

Vulnerability Analysis

This vulnerability represents an incomplete fix for a previously disclosed SSRF issue (GHSA-jcc6-f9v6-f7jw). The core problem lies in the fetch_and_encode_favicon() function, which uses requests.get(favicon_url, ...) with default redirect-following behavior enabled. While the original remediation implemented validation for redirects on the main page URL, this validation was not extended to the favicon fetch path.

The vulnerability is classified under CWE-918 (Server-Side Request Forgery), which occurs when an application fetches a remote resource without properly validating user-supplied URLs. In this case, the incomplete validation allows an attacker to craft a malicious HTML page containing a link tag with an href attribute that performs an HTTP redirect to a private IP address or internal service.

Root Cause

The root cause stems from inconsistent security controls between different URL fetching operations within the application. The main page URL validation was updated to prevent SSRF via redirects, but the favicon fetching logic was overlooked. The fetch_and_encode_favicon() function continues to use the Python requests library with its default configuration, which automatically follows HTTP redirects (301, 302, 307, 308) without additional validation.

This architectural inconsistency means that while direct requests to internal IP addresses may be blocked, an attacker can bypass this protection by hosting an external page that redirects the favicon request to an internal resource.

Attack Vector

The attack requires network access and authentication with low privileges. An attacker can exploit this vulnerability through the following approach:

1. The attacker creates a malicious HTML page on an external server containing a link tag with an href pointing to a controlled redirect endpoint
2. The redirect endpoint returns an HTTP redirect response (e.g., 302) pointing to an internal IP address or sensitive internal service
3. The attacker uses the "Add link" functionality in Plane to add this malicious URL
4. Plane fetches the page and attempts to retrieve the favicon, following the redirect to the internal resource
5. The response from the internal resource is processed and potentially exposed to the attacker

The vulnerability can be exploited to access internal services, read sensitive configuration data, or map internal network topology. Since this is a full read SSRF, attackers can exfiltrate data from internal resources that would otherwise be inaccessible from the external network.

Detection Methods for CVE-2026-39843

Indicators of Compromise

• Unusual outbound HTTP requests from the Plane application server to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• Link additions in Plane that reference external URLs with redirect capabilities
• HTTP requests from the application server to cloud metadata endpoints (e.g., 169.254.169.254)
• Favicon fetch requests that result in connections to non-standard ports or internal services

Detection Strategies

• Implement network monitoring to detect HTTP requests from the Plane server to internal IP ranges or sensitive endpoints
• Review application logs for link additions containing suspicious external URLs or known redirect services
• Monitor DNS queries from the Plane server for resolution of internal hostnames or unusual patterns
• Deploy web application firewall (WAF) rules to detect SSRF patterns in request URLs

Monitoring Recommendations

• Enable detailed logging for all outbound HTTP requests made by the Plane application
• Configure alerts for connections to internal IP ranges from the application server
• Monitor for access to cloud provider metadata services from the Plane deployment
• Implement network segmentation monitoring to detect lateral movement attempts

How to Mitigate CVE-2026-39843

Immediate Actions Required

• Upgrade Plane to version 1.3.0 or later immediately
• Review recent link additions for potentially malicious URLs targeting internal resources
• Implement network-level egress filtering to restrict outbound connections from the Plane server
• Audit user accounts with link creation privileges for suspicious activity

Patch Information

The vulnerability is fixed in Plane version 1.3.0. Organizations running versions 0.28.0 through 1.2.x should upgrade immediately. For detailed information about the fix, refer to the GitHub Security Advisory.

Workarounds

• Restrict the "Add link" functionality to trusted users only until the patch can be applied
• Implement network-level controls to block outbound requests from the Plane server to internal IP ranges
• Deploy a reverse proxy or WAF that can inspect and block redirects to internal addresses
• Consider temporarily disabling favicon fetching if the functionality is not critical

# Network egress filtering example using iptables
# Block outbound connections to private IP ranges from the Plane server

# Block RFC 1918 private address ranges
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner plane -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner plane -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner plane -j DROP

# Block link-local addresses
iptables -A OUTPUT -d 169.254.0.0/16 -m owner --uid-owner plane -j DROP

# Block localhost (prevent attacks via localhost redirects)
iptables -A OUTPUT -d 127.0.0.0/8 -m owner --uid-owner plane -j DROP