CVE-2026-30242: Plane has SSRF via Incomplete IP Validation in Webhook URL Serializer

March 5, 2026 (updated March 9, 2026)

The webhook URL validation in plane/app/serializers/webhook.py only checks ip.is_loopback, allowing attackers with workspace ADMIN role to create webhooks pointing to private/internal network addresses (10.x.x.x, 172.16.x.x, 192.168.x.x, 169.254.169.254, etc.). When webhook events fire, the server makes requests to these internal addresses and stores the response — enabling SSRF with full response read-back.

References

github.com/advisories/GHSA-fpx8-73gf-7x73
github.com/makeplane/plane
github.com/makeplane/plane/releases/tag/v1.2.3
github.com/makeplane/plane/security/advisories/GHSA-fpx8-73gf-7x73
nvd.nist.gov/vuln/detail/CVE-2026-30242

Code Behaviors & Features

Detect and mitigate CVE-2026-30242 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →