CVE-2026-27706: Plane Vulnerable to Full Read SSRF via Favicon Fetching in "Add Link" Feature
Plane is an an open-source project management tool. Prior to version 1.2.2, a Full Read Server-Side Request Forgery (SSRF) vulnerability has been identified in the "Add Link" feature. This flaw allows an authenticated attacker with general user privileges to send arbitrary GET requests to the internal network and exfiltrate the full response body. By exploiting this vulnerability, an attacker can steal sensitive data from internal services and cloud metadata endpoints. Version 1.2.2 fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27706?
CVE-2026-27706 is classified as a critical vulnerability due to the potential for full read access through SSRF.
How do I fix CVE-2026-27706?
To fix CVE-2026-27706, update to Plane version 1.2.2 or later, which addresses the vulnerability.
What are the implications of CVE-2026-27706?
The implications of CVE-2026-27706 include unauthorized access to internal data and possible exploitation by authenticated users.
Who is affected by CVE-2026-27706?
CVE-2026-27706 affects all users of Plane versions prior to 1.2.2.
What is Server-Side Request Forgery in the context of CVE-2026-27706?
In the context of CVE-2026-27706, Server-Side Request Forgery allows an authenticated attacker to send unauthorized requests from the server, potentially exposing sensitive internal resources.