CVE-2026-105628

Summary

Plane's OAuth avatar synchronization feature was vulnerable to server-side request forgery (SSRF) that allowed attackers to fetch internal resources and expose them via public asset URLs. This could lead to information disclosure of internal system data.

Exploitability

Moderately difficult to exploit as it requires an attacker to have access to a user account with OAuth integration and craft a malicious avatar URL that redirects to internal resources, but the attack can be automated once the initial access is gained.

Blast radius

The impact could be significant as attackers could potentially exfiltrate sensitive internal metadata or configuration data through exposed avatar files, affecting multiple users if the vulnerability is exploited at scale.

Detection

Monitor for unusual HTTP requests to internal IP addresses from the Plane application server, particularly those originating from OAuth avatar fetch operations, and watch for access patterns to /api/assets/v2/static/ endpoints with newly created asset IDs.

Prioritized remediation

Upgrade to Plane 1.4.0 or later to fix the SSRF vulnerability in the OAuth avatar synchronization flow.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.