Plane CVE-2026-105628

The Plane instance must be configured with OAuth-based authentication and have the avatar synchronization flow active, and the attacker must control the avatar_url field returned in their OAuth provider profile data. The server-side fetch performs no internal-IP validation and follows redirects by default (pre-1.4.0), so the attacker points avatar_url at a host that redirects to an internal target. Meaningful impact further requires that Plane's server can reach a sensitive internal endpoint (e.g., a cloud metadata service at 169.254.169.254 or an internal admin API) - so cloud-hosted deployments are most exposed. Limiting factors: an attacker needs a usable OAuth login to trigger the flow, instances not using OAuth avatar sync are unaffected, and environments with no reachable internal secrets yield little of value.

This is a legitimate but conditional risk, not a drop-everything emergency. The CVSS 3.1 base score of 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N) reflects a network-reachable, low-complexity SSRF (CWE-918) whose scope change and C:H capture the real danger: fetching an internal-only resource such as a cloud metadata endpoint and exposing the response as a downloadable avatar asset, which can disclose IAM credentials or other internal data. However, several signals temper this. No EPSS score, no CISA KEV listing, and no public exploit were provided, so exploitation status is 'no public exploit identified at time of analysis' - the only public artifacts are the vendor patch (PR #9163, commit 04622ce, release v1.4.0) and the GHSA advisory, which confirm the flaw but are not weaponized exploit code. The NVD vector states PR:H (authenticated/high-privilege), yet the described mechanism only requires an attacker to control their own OAuth provider profile's avatar_url, which in practice is closer to PR:L (any user able to complete an OAuth login) - I flag this discrepancy for verification. Realistic impact is also gated on deployment: the payoff (metadata/credential theft) materializes mainly on cloud-hosted Plane instances with reachable internal services and OAuth avatar sync in use. Net: a real priority for self-hosted Plane operators on cloud infrastructure, but lower urgency where OAuth is unused or no sensitive internal endpoints are reachable.

An attacker logs into a Plane instance via an OAuth provider whose profile they control, setting their avatar_url to a server they operate that 302-redirects to http://169.254.169.254/latest/meta-data/ (or another internal endpoint). Plane's avatar sync follows the redirect server-side with no internal-IP validation, uploads the fetched metadata/credential response as the user's avatar, and exposes it at /api/assets/v2/static/{asset_id}/, which the attacker then downloads to exfiltrate internal content. No public exploit code was identified, but the vendor patch and advisory precisely document the flow.