CVE-2026-105628 in Plane
Summary
by MITRE • 10/05/2026
Plane is an open-source project management tool. Prior to 1.4.0, Plane's OAuth avatar synchronization flow fetches avatar_url from provider user data through a server-side HTTP request without internal IP validation and follows redirects by default. An attacker can provide an avatar URL that redirects to an internal-only resource, such as a metadata endpoint, and Plane uploads the fetched response as a user avatar file. The object is then exposed through /api/assets/v2/static/{asset_id}/, allowing exfiltration of internally fetched content. This issue is fixed in 1.4.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/05/2026
Plane versions prior to 1.4.0 contain an insecure direct object reference vulnerability within the OAuth avatar synchronization mechanism that facilitates server-side request forgery and subsequent data exfiltration from internal network resources. The application's design flaw lies in its handling of user-supplied URLs during the profile update process via OAuth providers. When a user authenticates or updates their profile, Plane retrieves an avatar URL provided by the identity provider and initiates a server-side HTTP GET request to fetch the image data for storage as a local asset. This implementation fails to implement any internal IP validation or allowlist restrictions on the destination host of this outbound request. Consequently, if the supplied URL contains redirect instructions pointing toward private network addresses such as cloud metadata endpoints like 169.254.169.254 for AWS EC2 instances or similar local service interfaces, the server will follow these redirects and retrieve sensitive internal data that is not intended to be accessible from external networks.
The operational impact of this vulnerability extends beyond simple information disclosure due to how Plane handles the fetched content. After retrieving the response body from the potentially malicious redirect target, the application saves this data as a user avatar file within its local storage system. Crucially, these stored assets are then exposed through a public API endpoint located at /api/assets/v2/static/{asset_id}/ without adequate access controls or validation regarding the origin of the content. This architectural oversight transforms what might initially appear as a limited SSRF into a persistent data exfiltration vector. An attacker can craft an OAuth provider configuration that points to an internal metadata service, trigger the avatar synchronization process, and subsequently retrieve the stolen credentials, instance identity documents, or other sensitive configurations by accessing the public asset URL associated with their user account. This allows for the remote extraction of high-value secrets from cloud environments where Plane is deployed without requiring direct network access to those internal services.
From a vulnerability classification perspective, this issue aligns closely with CWE-918 Server-Side Request Forgery and CWE-20 Improper Input Validation. The failure to validate that outbound requests are directed only toward expected external domains constitutes a critical input validation error. Furthermore, the exposure of internally fetched content through a public interface relates to CWE-643 Exposure of Internal Information Through Error Messages or Data Retrieval mechanisms when combined with improper access controls on static assets. In terms of adversary tactics, this vulnerability maps to ATT&CK technique T1557 Adversary-in-the-Middle if used for credential harvesting from local services, but more accurately reflects T1046 Network Service Discovery and T1078 Valid Accounts when leveraging compromised OAuth tokens to access internal resources. The exploitation chain relies on the attacker controlling an input field that is processed server-side without sanitization of the resulting network destination.
Mitigation strategies for this vulnerability involve immediate upgrading to Plane version 1.4.0 or later, where the developers have addressed these flaws by implementing strict allowlisting mechanisms for outbound HTTP requests and validating IP addresses against known private ranges before processing them. For organizations unable to upgrade immediately, deploying a web application firewall with rules that block outbound connections from the Plane server to internal IP ranges can provide temporary protection. Additionally, configuring the underlying OAuth provider integration to reject or sanitize URLs containing redirects is advisable if such configuration options are available within the identity provider's settings. Security teams should also audit existing user avatars for any anomalous data patterns and rotate any credentials that may have been exposed through this vector in affected deployments.