CVE-2026-30242 in plane
Summary
by MITRE • 03/07/2026
Plane is an an open-source project management tool. Prior to version 1.2.3, the webhook URL validation in plane/app/serializers/webhook.py only checks ip.is_loopback, allowing attackers with workspace ADMIN role to create webhooks pointing to private/internal network addresses (10.x.x.x, 172.16.x.x, 192.168.x.x, 169.254.169.254, etc.). When webhook events fire, the server makes requests to these internal addresses and stores the response — enabling SSRF with full response read-back. This issue has been patched in version 1.2.3.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 03/12/2026
The vulnerability described in CVE-2026-30242 affects Plane, an open-source project management tool, and represents a significant server-side request forgery (SSRF) flaw that stems from inadequate webhook URL validation. This vulnerability exists in versions prior to 1.2.3 and specifically targets the webhook configuration functionality within the application's serialization layer. The flaw is rooted in the validation logic located in plane/app/serializers/webhook.py which fails to properly validate webhook URLs against internal network ranges, creating a pathway for malicious actors to exploit the system's network communication capabilities.
The technical implementation of this vulnerability demonstrates a classic SSRF weakness where the system only validates whether a webhook URL points to a loopback address using ip.is_loopback check. This validation is insufficient because it does not account for the broader range of private and internal network addresses that could be targeted. Attackers with workspace ADMIN privileges can leverage this flaw to create webhooks that point to internal network addresses such as 10.x.x.x, 172.16.x.x, 192.168.x.x, and the special address 169.254.169.254, which is commonly used for metadata services in cloud environments. When webhook events are triggered, the server automatically makes HTTP requests to these internal addresses and captures the responses, effectively enabling attackers to read back the contents of internal services.
The operational impact of this vulnerability is substantial as it provides attackers with a means to perform internal network reconnaissance and potentially access sensitive internal services that would normally be protected by network segmentation. The ability to read back full server responses from internal endpoints means that attackers can gather information about internal systems, services, and potentially extract sensitive data or credentials that may be exposed through these responses. This vulnerability aligns with CWE-918, which specifically addresses server-side request forgery vulnerabilities, and represents a clear violation of secure coding practices that should prevent unvalidated input from being used in network requests. The attack vector is particularly concerning because it requires only administrative privileges within a workspace, which is often a lower barrier to entry than other types of network-based attacks.
The mitigation for this vulnerability involves implementing comprehensive URL validation that checks against known private network ranges and ensures that webhook URLs cannot point to internal addresses. This approach aligns with ATT&CK technique T1071.004 for application layer protocol: DNS and reflects the need for proper input sanitization and validation. Organizations should update to version 1.2.3 or later where the patch addresses the insufficient validation by implementing proper network range checking and blocking access to private IP address spaces. Additionally, implementing network segmentation, using network firewalls to restrict outbound connections from the application server, and employing proper access controls to limit who can configure webhooks would provide additional defense-in-depth measures. The vulnerability also highlights the importance of following secure coding guidelines and conducting regular security reviews of network communication functions, particularly those involving external URL validation and request handling.