CVE-2026-104973

Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-30242 validates webhook IP addresses only when the webhook is created in apps/api/plane/app/serializers/webhook.py. The delivery task in apps/api/plane/bgtasks/webhooktask.py performs a separate DNS resolution...

CVE-2026-105636

Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhooktask.py calls requests.post without allowredirects=False and does not validate redirect targets. validateurl blocks private, loopback, link-local, and reserved addresses in...

CVE-2026-104973

The open-source project management tool Plane is vulnerable to a Server-Side Request Forgery (SSRF) via a DNS rebinding bypass. Prior to version 1.4.0 , the application only validated webhook IP addresses during creation in apps/api/plane/app/serializers/webhook.py. However, the delivery task in ...