OCTOBER 7, 2026
Live Feed
Back to database
Case File

CVE-2026-104973

HIGH · CVSS 7.6 EPSS 0.27% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-10-05 · Last synced 2026-10-06

CyberRota Analysis

AI-Generated

The Plane project management tool is vulnerable to a Server-Side Request Forgery (SSRF) due to inadequate validation of resolved IP addresses during webhook delivery, which can allow attackers to exploit DNS rebinding techniques. This flaw can lead to unauthorized access to internal services, potentially compromising sensitive data. Organizations using versions prior to 1.4.0 should prioritize upgrading to mitigate this high-severity risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-104973
Severity
HIGH
CVSS
7.6
EPSS
0.27%

Original NVD Description

Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-30242 validates webhook IP addresses only when the webhook is created in apps/api/plane/app/serializers/webhook.py. The delivery task in apps/api/plane/bgtasks/webhook_task.py performs a separate DNS resolution when sending the request and does not validate the resolved IP address, allowing DNS rebinding to bypass the SSRF protection. This issue is fixed in 1.4.0.