All vulnerabilities
CVE-2026-104973CVE-2026-102282GHSA-j5f4-cc29-5x44GHSA-whh3-5g95-4qhc

Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery

makeplane planenpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.6High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 7 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 17% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.4.0Also 0.6.1GitHub
Published5 Oct 2026Updated 8 Oct 2026CVE List

What fixes it

  • 1.4.0makeplane/plane, otherGitHub
  • 0.6.1adm-zip, npmOSVnpm install adm-zip@0.6.1

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-30242 validates webhook IP addresses only when the webhook is created in apps/api/plane/app/serializers/webhook.py. The delivery task in apps/api/plane/bgtasks/webhook_task.py performs a separate DNS resolution when sending the request and does not validate the resolved IP address, allowing DNS rebinding to bypass the SSRF protection. This issue is fixed in 1.4.0.

Text from CVE List

Affected versions 3

  • planeaffected: < 1.4.0CVE List
  • makeplane/plane, other<= 1.3.1GitHub
  • adm-zip, npmfrom first release, fixed in 0.6.1OSV

References 5