CVE-2026-27706
High
Description
Plane is an an open-source project management tool. Prior to version 1.2.2, a Full Read Server-Side Request Forgery (SSRF) vulnerability has been identified in the "Add Link" feature. This flaw allows an authenticated attacker with general user privileges to send arbitrary GET requests to the internal network and exfiltrate the full response body. By exploiting this vulnerability, an attacker can steal sensitive data from internal services and cloud metadata endpoints. Version 1.2.2 fixes the issue.
SeverityHigh
CVSS7.7
Exploit probability—
ProductPlane
PublishedFeb 25, 2026
First seenFeb 25, 2026
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Update
- plane plane1.2.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| plane plane | v < 1.2.2 | 1.2.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.