Plane has SSRF via Incomplete IP Validation in Webhook URL Serializer
Summary
The webhook URL validation in plane/app/serializers/webhook.py only checks ip.is_loopback, allowing attackers with workspace ADMIN role to create webhooks pointing to private/internal network addresses (10.x.x.x, 172.16.x.x, 192.168.x.x, 169.254.169.254, etc.). When webhook events fire, the server makes requests to these internal addresses and stores the response — enabling SSRF with full response read-back.
Impact
- Cloud metadata exfiltration: Access AWS/GCP/Azure instance metadata (IAM credentials, tokens)
- Internal service scanning: Probe internal network services not exposed to the internet
- Data exfiltration via response logs: Full response body from internal services is stored and returned to the attacker through the webhook logs API
- Bypass vectors:
10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.254.0.0/16,0.0.0.0,::ffff:mapped addresses
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | plane | < 1.2.3 | 1.2.3 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N- Weakness (CWE)
CWE-918- Platform
- Python (PyPI)
- Package
plane- Disclosed
- 05.03.2026
- Updated
- 11.10.2026 12:19
Sources and licenses
OSV / GitHub Advisory Database - GHSA-fpx8-73gf-7x73 - CC BY 4.0
Vulnerability history: plane
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 03.2026 03.2026
- Without a fix
- 1
- Exploited in attacks
- 0
Severity breakdown
- High 2
Disclosures per year
- 2026: 2
-
Plane has SSRF via Incomplete IP Validation in Webhook URL Serializer this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.