CVE-2026-30242 Plane: SSRF via Incomplete IP Validation in Webhook URL Serializer
Workspace admins can exploit incomplete IP validation to perform Server-Side Request Forgery, accessing internal network resources and reading responses.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-30242?
CVE-2026-30242 is a high-severity server-side request forgery vulnerability in makeplane plane, published on 6 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Plane is an an open-source project management tool. Prior to version 1.2.3, the webhook URL validation in plane/app/serializers/webhook.py only checks ip.is_loopback, allowing attackers with workspace ADMIN role to create webhooks pointing to private/internal network addresses (10.x.x.x, 172.16.x.x, 192.168.x.x, 169.254.169.254, etc.). When webhook events fire, the server makes requests to these internal addresses and stores the response — enabling SSRF with full response read-back. This issue has been patched in version 1.2.3.
Weakness: CWE-918
Which versions are affected by CVE-2026-30242?
2 open source packages ship an affected version, including plane. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
plane PyPI | All versions | 1.2.3 |
plane PyPI | All versions | 1.2.3 |
Products include Plane Plane.
How do I fix CVE-2026-30242?
Upgrade plane to 1.2.3 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-30242 being exploited?
There is no known exploitation of CVE-2026-30242 in the wild and no public exploit code.
Other vulnerabilities in makeplane plane
- CVE-2024-47830 Plane allows server side request forgery via /_next/image endpoint
- CVE-2026-46558 Missing authorization in plane
- CVE-2026-39843 Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching
- CVE-2026-27706 Plane Vulnerable to Full Read SSRF via Favicon Fetching in "Add Link" Feature
- CVE-2026-30244 Plane: Unauthenticated Workspace Member Information Disclosure
Sources
Also known as GHSA-fpx8-73gf-7x73.