Plane CVE-2026-104973

Exploitation requires an authenticated principal with privileges to create or edit webhooks (a workspace-admin capability, consistent with PR:H) on a self-hosted Plane instance running a version prior to 1.4.0 that already applied the CVE-2026-30242 creation-time IP check. The attacker must control authoritative DNS for the webhook hostname so it first resolves to an allowed public IP (passing the serializer validation in apps/api/plane/app/serializers/webhook.py) and then rebinds to an internal IP before the delivery task in apps/api/plane/bgtasks/webhook_task.py performs its own separate, unvalidated resolution. Limiting factors: the webhook-configuration privilege requirement, the need to win the DNS-rebinding TOCTOU race between the two resolutions, and the fact that the CVE-2026-30242 SSRF protection is otherwise present (this is a bypass, not an absence of controls).

This is a genuine but conditional SSRF (CWE-918), rated CVSS 7.6 (High) with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N. The scope-change (S:C) and high confidentiality impact (C:H) correctly reflect that a successful attack reaches internal network services beyond the Plane application itself. Crucially, PR:H confirms the attacker must already hold elevated privileges - specifically the ability to create/configure webhooks (a workspace-admin capability) - which substantially narrows the realistic attacker population to insiders or accounts already compromised at an admin level, not anonymous internet attackers. No EPSS score was provided, there is no CISA KEV listing, and no public exploit code was identified in the supplied intelligence, so exploitation status is 'no public exploit identified at time of analysis.' One signal is in tension with the raw score: the published vector lists AC:L, but the vulnerability is a DNS-rebinding TOCTOU bypass that in practice requires the attacker to control authoritative DNS and win a timing race between the creation-time validation and the delivery task's separate resolution - a specialized precondition that arguably warrants AC:H. Net: this is a real priority for self-hosted Plane operators who expose webhook configuration to lower-trust users, but the PR:H prerequisite plus the rebinding race keep it below the tier of wormable, unauthenticated SSRF. Patch to 1.4.0 is confirmed available.

A user holding webhook-configuration privileges in a self-hosted Plane instance (prior to 1.4.0) registers a webhook pointing at an attacker-controlled hostname that initially resolves to a benign public IP, passing the creation-time validation added for CVE-2026-30242. The attacker's DNS server then rebinds the name to an internal address (e.g., a cloud metadata endpoint or internal admin service); when the Celery delivery task later performs its own, unvalidated DNS resolution and sends the POST, the request is directed to the internal target. No public exploit code was identified at time of analysis.