# CVE-2026-30242: plane SSRF β€” Fixed in 1.2.3 🐍 🐍 PyPI Not in CISA KEV HIGH severity # CVE-2026-30242 β€” plane HIGH CVE-2026-30242 is a high-severity (CVSS 8.5) Server-Side Request Forgery (SSRF) vulnerability in plane. A fix is available for plane β€” see the affected versions and patch details below. Plane: SSRF via Incomplete IP Validation in Webhook URL Serializer Also known as[GHSA-fpx8-73gf-7x73](/vulnerability/GHSA-fpx8-73gf-7x73) Published Mar 6, 2026 Updated Oct 28, 2026 Affected 1 pkg Patched 1 / 1 Exploits None indexed Exploitation data as of Nov 8, 2026 Β· OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### No confirmed exploitation observed yet - CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment. Exploitation and automatability from CISA’s SSVC triage for CVE-2026-30242. ## EPSS Exploitation Probability [via FIRST.org β†—](https://www.first.org/epss/) 0.4%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs32th percentile β€” riskier than 32% of all scored CVEsHighest risk 0.00%0.29%0.58%0.88%0.0%0.4%May 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 1 pkg affected 🐍`plane` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages β€” download data is not available via public APIs for these ecosystems. ## Description #### Summary The webhook URL validation in `plane/app/serializers/webhook.py` only checks `ip.is_loopback`, allowing attackers with workspace ADMIN role to create webhooks pointing to private/internal network addresses (`10.x.x.x`, `172.16.x.x`, `192.168.x.x`, `169.254.169.254`, etc.). When webhook events fire, the server makes requests to these internal addresses and stores the response β€” enabling SSRF with full response read-back. #### Impact - **Cloud metadata exfiltration**: Access AWS/GCP/Azure instance metadata (IAM credentials, tokens) - **Internal service scanning**: Probe internal network services not exposed to the internet - **Data exfiltration via response logs**: Full response body from internal services is stored and returned to the attacker through the webhook logs API - Bypass vectors: `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.0.0/16`, `0.0.0.0`, `::ffff:` mapped addresses ## Affected Packages 1 total 1 fixed Ecosystem Package Vulnerable range Fix 🐍PyPI `plane` all versions 1.2.3`pip install --upgrade 'plane==1.2.3'` ## Affected Products 1 product Β· 1 configurations Application `plane`plane < 1.2.3 range ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for plane, including transitive dependencies β€” a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update plane to 1.2.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range β€” O3 confirms CVE-2026-30242 is resolved across your whole dependency graph. 3. ### Workarounds Restrict outbound requests from the affected component to an allowlist of hosts, block access to link-local and internal address ranges at the network layer, and require authentication on internal services so a forged request cannot reach them unauthenticated. ## Frequently Asked Questions \### Summary The webhook URL validation in \`plane/app/serializers/webhook.py\` only checks \`ip.is\_loopback\`, allowing attackers with workspace ADMIN role to create webhooks pointing to private/internal network addresses (\`10.x.x.x\`, \`172.16.x.x\`, \`192.168.x.x\`, \`169.254.169.254\`, etc.). When webhook events fire, the server makes requests to these internal addresses and stores the response β€” enabling SSRF with full response read-back. ### Impact - \*\*Cloud metadata exfiltration\*\*: Access AWS/GCP/Azure instance metadata (IAM credentials, tokens) - \*\*Internal service scanning\*\*: Probe internal netw O3 Security Β· Impact-Aware SCA ### Is CVE-2026-30242 in your dependencies? Find it across PyPI, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)