CVE-2026-27706

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27706", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-23T17:56:51.202Z", "datePublished": "2026-02-25T15:56:11.220Z", "dateUpdated": "2026-02-25T20:13:05.310Z"}, "containers": {"cna": {"title": "Plane Vulnerable to Full Read SSRF via Favicon Fetching in \"Add Link\" Feature", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/makeplane/plane/security/advisories/GHSA-jcc6-f9v6-f7jw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/makeplane/plane/security/advisories/GHSA-jcc6-f9v6-f7jw"}, {"name": "https://github.com/makeplane/plane/releases/tag/v1.2.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/makeplane/plane/releases/tag/v1.2.2"}], "affected": [{"vendor": "makeplane", "product": "plane", "versions": [{"version": "< 1.2.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T15:56:11.220Z"}, "descriptions": [{"lang": "en", "value": "Plane is an an open-source project management tool. Prior to version 1.2.2, a Full Read Server-Side Request Forgery (SSRF) vulnerability has been identified in the \"Add Link\" feature. This flaw allows an authenticated attacker with general user privileges to send arbitrary GET requests to the internal network and exfiltrate the full response body. By exploiting this vulnerability, an attacker can steal sensitive data from internal services and cloud metadata endpoints. Version 1.2.2 fixes the issue."}], "source": {"advisory": "GHSA-jcc6-f9v6-f7jw", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-25T20:12:47.055590Z", "id": "CVE-2026-27706", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T20:13:05.310Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27706", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-25T20:12:47.055590Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T20:12:53.756Z"}}], "cna": {"title": "Plane Vulnerable to Full Read SSRF via Favicon Fetching in \"Add Link\" Feature", "source": {"advisory": "GHSA-jcc6-f9v6-f7jw", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "makeplane", "product": "plane", "versions": [{"status": "affected", "version": "< 1.2.2"}]}], "references": [{"url": "https://github.com/makeplane/plane/security/advisories/GHSA-jcc6-f9v6-f7jw", "name": "https://github.com/makeplane/plane/security/advisories/GHSA-jcc6-f9v6-f7jw", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/makeplane/plane/releases/tag/v1.2.2", "name": "https://github.com/makeplane/plane/releases/tag/v1.2.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Plane is an an open-source project management tool. Prior to version 1.2.2, a Full Read Server-Side Request Forgery (SSRF) vulnerability has been identified in the \"Add Link\" feature. This flaw allows an authenticated attacker with general user privileges to send arbitrary GET requests to the internal network and exfiltrate the full response body. By exploiting this vulnerability, an attacker can steal sensitive data from internal services and cloud metadata endpoints. Version 1.2.2 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T15:56:11.220Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27706", "state": "PUBLISHED", "dateUpdated": "2026-02-25T20:13:05.310Z", "dateReserved": "2026-02-23T17:56:51.202Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-25T15:56:11.220Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "plane", "vendor": "makeplane", "versions": [{"status": "affected", "version": "< 1.2.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:plane:plane:*:*:*:*:*:*:*:*", "matchCriteriaId": "5CFB7634-F7C4-45BE-BCA9-FB73B6287FAC", "versionEndExcluding": "1.2.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Plane is an an open-source project management tool. Prior to version 1.2.2, a Full Read Server-Side Request Forgery (SSRF) vulnerability has been identified in the \"Add Link\" feature. This flaw allows an authenticated attacker with general user privileges to send arbitrary GET requests to the internal network and exfiltrate the full response body. By exploiting this vulnerability, an attacker can steal sensitive data from internal services and cloud metadata endpoints. Version 1.2.2 fixes the issue."}, {"lang": "es", "value": "Plane es una herramienta de gesti\u00f3n de proyectos de c\u00f3digo abierto. Antes de la versi\u00f3n 1.2.2, se ha identificado una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) de lectura completa en la caracter\u00edstica 'Add Link'. Esta falla permite a un atacante autenticado con privilegios de usuario generales enviar peticiones GET arbitrarias a la red interna y exfiltrar el cuerpo completo de la respuesta. Al explotar esta vulnerabilidad, un atacante puede robar datos sensibles de servicios internos y puntos finales de metadatos en la nube. La versi\u00f3n 1.2.2 corrige el problema."}], "id": "CVE-2026-27706", "lastModified": "2026-06-17T10:27:33.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27706", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-25T20:12:47.055590Z", "version": "2.0.3"}}]}, "published": "2026-02-25T17:25:39.740", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/makeplane/plane/releases/tag/v1.2.2"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/makeplane/plane/security/advisories/GHSA-jcc6-f9v6-f7jw"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.2.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "plane", "source": "cna", "vendor": "makeplane"}, "product": "plane", "vendor": "makeplane"}], "analysis": {"en": {"generated_at": "2026-04-18T10:41:05.990099+00:00", "value": {"mitigation_remediation": ["Upgrade Plane to version 1.2.2 or later, which removes the SSRF flaw.", "If an immediate upgrade is not possible, restrict the \"Add Link\" feature to administrators or disable it entirely for standard users.", "Implement network segmentation or firewall rules to block outbound requests from the Plane application to internal or cloud metadata endpoints."], "summary": {"action": "Immediate Patch", "impact": "Full Read Server\u2011Side Request Forgery (SSRF)"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Plane project management tool from makeplane. All installations running a version older than 1.2.2 are impacted; version 1.2.2 and later include the fix.", "description_and_impact": "An authenticated user with general privileges can add a link in Plane\u2019s \"Add Link\" feature, prompting the server to fetch arbitrary URLs. The fetched response body is returned to the attacker, allowing the acquisition of internal network data, cloud metadata, or other sensitive resources. The flaw does not provide code execution or privilege escalation, but exposes confidential information and can be used to map internal services.", "risk_and_exploitability": "The CVSS score of 7.7 indicates high risk, while the EPSS score of less than 1% suggests that current exploitation activity is low, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a web-based SSRF performed by an authenticated user; no additional privilege escalation is required."}}}}, "created": "2026-02-26T13:15:46.953610+00:00", "updated": "2026-04-18T10:45:43.667224+00:00", "vendors": ["makeplane", "makeplane$PRODUCT$plane"]}