CVE-2026-27706

EUVD-2026-8682 · Published Feb 25, 2026

Plane is an an open-source project management tool. Prior to version 1.2.2, a Full Read Server-Side Request Forgery (SSRF) vulnerability has been identified in the "Add Link" feature. This flaw allows an authenticated attacker with general user privileges to send arbitrary GET requests to the internal network and exfiltrate the full response body. By exploiting this vulnerability, an attacker can steal sensitive data from internal services and cloud metadata endpoints. Version 1.2.2 fixes the issue.

Technologies

Plane Plane

Weaknesses

CWE-918

CVSS scores

v3.17.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access

T1190Exploit Public-Facing Application

References

https://github.com/makeplane/plane/releases/tag/v1.2.2
https://github.com/makeplane/plane/security/advisories/GHSA-jcc6-f9v6-f7jw

Potentially impacted assets

See if this affects your attack surface