Plane CVE-2026-104977

Requires an authenticated account with project-member privileges (PR:L) on a Plane instance running an affected version (the v1.3.1 GA line, where the v1.2.2 fix for CVE-2026-27706 remains incomplete). The specific abused feature is server-side work-item link unfurling, which fetches attacker-supplied URLs and returns the response body as the link title/favicon, making this a readable (non-blind) SSRF. Impact is greatest on cloud-hosted deployments where the link-fetcher can reach the instance metadata service at 169.254.169.254 to steal IAM credentials. Limiting factors: exploitation requires prior authentication as a project member (not fully anonymous/remote), depends on the link-unfurling feature being in use, and the highest-value outcome depends on the deployment being in a cloud environment with reachable internal metadata/services.

This is a credible, above-average-priority SSRF (CWE-918) that should be patched promptly, though it is not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H) is internally consistent with the description: network-reachable, low attack complexity, and only low privileges (any authenticated project member) are required, with a scope change (S:C) that correctly reflects the server pivoting to attack other systems such as the cloud metadata endpoint. The high confidentiality impact (C:H, I:N, A:N) is justified because the response body is reflected back to the attacker as the link title/favicon - a readable SSRF, not blind - making cloud-credential theft via 169.254.169.254 realistic in cloud-hosted deployments. No EPSS score was provided in the input, and there is no CISA KEV listing and no public POC referenced, so exploitation is currently theoretical: no public exploit identified at time of analysis. The one tempering factor is the PR:L authentication gate - the attacker must already be a project member - which rules out opportunistic internet-wide mass exploitation and points toward insider or post-account-compromise abuse. Note also that this is explicitly an incomplete-fix regression (the prior fix for CVE-2026-27706/GHSA-jcc6-f9v6-f7jw shipped in v1.2.2 but was not fully effective in v1.3.1 GA), so operators who believed they were patched may still be exposed - verify the running version is 1.4.0 or later.

An authenticated low-privilege project member adds a work item link pointing at an internal-only URL (e.g. http://169.254.169.254/latest/meta-data/iam/security-credentials/). Plane's server-side link-unfurling fetches that URL and returns the response body to the attacker as the link's title or favicon, disclosing cloud IAM credentials or internal service data. No public exploit code was identified, but exploitation requires only standard project-member access and low complexity (AV:N/AC:L).