VulnSocial

CVE-2026-30242Disclosure(plane / plane)

LOWCVSS 8.5 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch plane plane systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Plane is an an open-source project management tool. Prior to version 1.2.3, the webhook URL validation in plane/app/serializers/webhook.py only checks ip.is_loopback, allowing attackers with workspace ADMIN role to create webhooks pointing to private/internal network addresses (10.x.x.x, 172.16.x.x, 192.168.x.x, 169.254.169.254, etc.). When webhook events fire, the server makes requests to these internal addresses and stores the response — enabling SSRF with full response read-back. This issue has been patched in version 1.2.3.

plane CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • plane

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked at 2 mentions on most recent observed day (2026-03-07)
  • 3 total mentions across 2 days

Affected systems

Vendors
plane
Products
plane

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-03-06: 1Mentions · 2026-03-07: 2Patch / Workaround · 2026-03-06: 1Technical Details · 2026-03-06: 1Technical Details · 2026-03-07: 103-0603-07
Signal classification2 categories
Disclosure
266.7%
Patch
133.3%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-03-061
Patch1
2026-03-072
Disclosure2
Full discourse3 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-30242 Plane is an an open-source project management tool. Prior to version 1.2.3, the webhook URL validation in plane/app/serializers/webhook.py only checks http://ip.is_loopback,… https://www.cve.org/CVERecord?id=CVE-2026-30242

    Post summary

    The post identifies CVE-2026-30242 in Plane, indicating a flaw in webhook URL validation before v1.2.3, but provides no PoC, exploit, active use, or patch details.

    0000093
    56.6K followersView on X
  • The Hacker Wire@TheHackerWire
    Disclosure

    🟠 CVE-2026-30242 - High Plane is an an open-source project management tool. Prior to version 1.2.3, the webhook URL validation in plane/app/serializers/webhook.py only checks http://ip.is_loopback, allowing attackers with ... https://www.thehackerwire.com/vulnerability/CVE-2026-30242/ https://t.co/kJEf7O4gCU

    Post summary

    The tweet announces a high‑severity vulnerability in Plane’s webhook validation logic, but offers no PoC, exploit tool, or patch details.

    0000042
    128 followersView on X
  • CVEFind.com@CveFindCom
    Patch

    [CVE-2026-30242: HIGH] Plane project management tool had a critical vulnerability allowing SSRF attacks up to version 1.2.3. Update to the latest version to patch this issue immediately.#cve,CVE-2026-30242,#cybersecurity https://cvefind.com/CVE-2026-30242

    Post summary

    The tweet alerts users to a critical SSRF vulnerability (CVE-2026-30242) in Plane project management tool versions up to 1.2.3 and urges an immediate update to the latest version.

    0000058
    597 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appplaneplane---

Explore more

Back to dashboardplane CVEsplane vulnerabilities