Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Plane is an an open-source project management tool. Prior to version 1.2.2, a Full Read Server-Side Request Forgery (SSRF) vulnerability has been identified in the "Add Link" feature. This flaw allows an authenticated attacker with general user privileges to send arbitrary GET requests to the internal network and exfiltrate the full response body. By exploiting this vulnerability, an attacker can steal sensitive data from internal services and cloud metadata endpoints. Version 1.2.2 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-27706 Plane is an an open-source project management tool. Prior to version 1.2.2, a Full Read Server-Side Request Forgery (SSRF) vulnerability has been identified in the "A… https://www.cve.org/CVERecord?id=CVE-2026-27706
Post summary
A SSRF vulnerability (CVE-2026-27706) was identified in Plane before v1.2.2, but no PoC, exploit, patch, or active exploitation details are provided.
CVE-2026-27706 Full Read Server-Side Request Forgery in Plane Project Management Tool Before 1.2.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27706
Post summary
A Server‑Side Request Forgery vulnerability (CVE‑2026‑27706) exists in Plane Project Management Tool versions before 1.2.2, as reported on Vulmon.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | plane | plane | - | - | - |