VYPR
← All advisories
High severity7.7NVD Advisory· Published Feb 25, 2026· Updated Jun 17, 2026

CVE-2026-27706

CVE-2026-27706

Description

Plane is an an open-source project management tool. Prior to version 1.2.2, a Full Read Server-Side Request Forgery (SSRF) vulnerability has been identified in the "Add Link" feature. This flaw allows an authenticated attacker with general user privileges to send arbitrary GET requests to the internal network and exfiltrate the full response body. By exploiting this vulnerability, an attacker can steal sensitive data from internal services and cloud metadata endpoints. Version 1.2.2 fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Plane/Plane3 versions
    cpe:2.3:a:plane:plane:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:plane:plane:*:*:*:*:*:*:*:*range: <1.2.2
    • (no CPE)range: <1.2.2
    • (no CPE)range: < 1.2.2

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.