CVE-2026-39843 Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching
An authenticated attacker can exploit incomplete redirect validation in favicon fetching to perform Server-Side Request Forgery and read private network resources.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-39843?
CVE-2026-39843 is a high-severity server-side request forgery vulnerability in makeplane plane, published on 9 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Plane is an an open-source project management tool. From 0.28.0 to before 1.3.0, the remediation of GHSA-jcc6-f9v6-f7jw is incomplete which could lead to the same full read Server-Side Request Forgery when a normal html page contains a link tag with an href that redirects to a private IP address is supplied to Add link by an authenticated attacker with low privileges. Redirects for the main page URL are validated, but not the favicon fetch path. fetch_and_encode_favicon() still uses requests.get(favicon_url, ...) with the default redirect-following. This vulnerability is fixed in 1.3.0.
Weakness: CWE-918
Which versions are affected by CVE-2026-39843?
It affects 1 product.
Products include Plane Plane.
How do I fix CVE-2026-39843?
No fix has been published for CVE-2026-39843 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-39843 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-39843 exists.
Other vulnerabilities in makeplane plane
- CVE-2024-47830 Plane allows server side request forgery via /_next/image endpoint
- CVE-2026-30242 Plane: SSRF via Incomplete IP Validation in Webhook URL Serializer
- CVE-2026-46558 Missing authorization in plane
- CVE-2026-27706 Plane Vulnerable to Full Read SSRF via Favicon Fetching in "Add Link" Feature
- CVE-2026-30244 Plane: Unauthenticated Workspace Member Information Disclosure
Sources
Also known as GHSA-9fr2-pprw-pp9j.