CVE-2026-30242 - Vulnerability Analysis

Overview

Plane < 1.2.3 contains a server-side request forgery caused by insufficient webhook URL validation allowing workspace ADMIN attackers to create webhooks pointing to internal network addresses, enabling SSRF with full response read-back.

Severity & Score

Impact

Attackers with workspace ADMIN role can perform SSRF to internal network addresses and read full responses, potentially exposing sensitive internal data.

Mitigation

Update to version 1.2.3 or later.

References

• https://github.com/makeplane/plane/releases/tag/v1.2.3
• https://github.com/makeplane/plane/security/advisories/GHSA-fpx8-73gf-7x73

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 7, 2026

🟠 CVE-2026-30242 - High (8.5) Plane is an an open-source project management tool. Prior to version 1.2.3, the webhook URL validation in plane/app/serializers/webhook.py only checks ip.is_loopback, allowing attackers with workspace ADMIN role to create webhooks pointing to priv... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30242/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner