GitHub Advisoryadvisory · PyPI

GHSA-fpx8-73gf-7x73 Plane has SSRF via Incomplete IP Validation in Webhook URL Serializer

HIGH Published 2026-03-05 Modified 2026-03-09 Official page ↗
Aliases
CVE-2026-30242
Ecosystem
PyPI
Packages
plane
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Weaknesses
CWE-918
Reviewed
2026-03-05

Affected packages

• PyPI plane: < 1.2.3 → fixed in 1.2.3

Description

Summary The webhook URL validation in `plane/app/serializers/webhook.py` only checks `ip.is_loopback`, allowing attackers with workspace ADMIN role to create webhooks pointing to private/internal network addresses (`10.x.x.x`, `172.16.x.x`, `192.168.x.x`, `169.254.169.254`, etc.). When webhook events fire, the server makes requests to these internal addresses and stores the response — enabling SSRF with full response read-back. Impact • Cloud metadata exfiltration: Access AWS/GCP/Azure instance metadata (IAM credentials, tokens) • Internal service scanning: Probe internal network services not exposed to the internet • Data exfiltration via response logs: Full response body from internal services is stored and returned to the attacker through the webhook logs API • Bypass vectors: `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.0.0/16`, `0.0.0.0`, `::ffff:` mapped addresses

Related

Alias · CVE (1)

  • CVE-2026-30242 Plane is an an open-source project management tool. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References