CVE-2026-104973

Summary

The Plane project management tool had a DNS rebinding vulnerability in webhook delivery that allowed attackers to bypass SSRF protections by resolving IP addresses during delivery rather than at creation time. This could enable remote code execution or data exfiltration through manipulated webhooks.

Exploitability

Exploitation requires an attacker to control a DNS server and set up a webhook with a domain name that resolves to an internal IP address, making it moderately difficult but achievable with DNS manipulation capabilities.

Blast radius

If exploited, this vulnerability could allow attackers to perform SSRF attacks against internal services, potentially leading to unauthorized access to internal systems, data leakage, or further compromise of the Plane application environment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.4.0 or later to receive the fix for CVE-2026-30242 that properly validates IP addresses during webhook delivery.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.