CVE-2026-105636: Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)
Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhooktask.py calls requests.post() without allowredirects=False and does not validate redirect targets. validateurl() blocks private, loopback, link-local, and reserved addresses in the original webhook URL, but the final URL reached after one or more redirects is not checked. A user who can create a workspace can register a webhook pointing to an attacker-controlled public endpoint that returns a 302 redirect to an internal address. The Plane worker then fetches internal resources, including cloud metadata, and stores the response body in webhooklogs, where the attacker can retrieve it through the workspace webhook-logs API. This issue is fixed in 1.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Planeto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs permission to create a workspace and to register a webhook. They can point the webhook at a public endpoint they control, which then redirects the Plane worker to an internal target.
Are deployments protected by the existing webhook URL validation?
No. The validation applies only to the original webhook URL and does not validate URLs reached through HTTP redirects. A redirect can therefore send the worker to private, loopback, link-local, or reserved addresses.
What could an attacker access or obtain?
The worker can fetch internal resources, including cloud metadata. The response body is stored in webhook logs, which the attacker can retrieve through the workspace webhook-logs API.
Which versions are affected and what is the remediation?
Plane versions prior to 1.4.0 are affected. Upgrade to version 1.4.0, which fixes the redirect handling issue.