GHSA-fpx8-73gf-7x73

Suggest an improvement
Source
https://github.com/advisories/GHSA-fpx8-73gf-7x73
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-fpx8-73gf-7x73/GHSA-fpx8-73gf-7x73.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-fpx8-73gf-7x73
Aliases
Published
2026-03-05T21:43:15Z
Modified
2026-03-09T13:16:29Z
Severity
  • 8.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N CVSS Calculator
Summary
Plane has SSRF via Incomplete IP Validation in Webhook URL Serializer
Details

Summary

The webhook URL validation in plane/app/serializers/webhook.py only checks ip.is_loopback, allowing attackers with workspace ADMIN role to create webhooks pointing to private/internal network addresses (10.x.x.x, 172.16.x.x, 192.168.x.x, 169.254.169.254, etc.). When webhook events fire, the server makes requests to these internal addresses and stores the response — enabling SSRF with full response read-back.

Impact

  • Cloud metadata exfiltration: Access AWS/GCP/Azure instance metadata (IAM credentials, tokens)
  • Internal service scanning: Probe internal network services not exposed to the internet
  • Data exfiltration via response logs: Full response body from internal services is stored and returned to the attacker through the webhook logs API
  • Bypass vectors: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, 0.0.0.0, ::ffff: mapped addresses
Database specific 
{
    "cwe_ids":  [
        "CWE-918"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-05T21:43:15Z",
    "nvd_published_at":  "2026-03-06T22:16:01Z",
    "severity":  "HIGH"
}
References

Affected packages

PyPI / plane

Package

Name
plane
View open source insights on deps.dev
Purl
pkg:pypi/plane

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.2.3

Affected versions

0.*
0.0.1
0.0.2
0.0.3
0.0.4
0.0.5
0.0.6
0.0.7
0.0.8
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.2.0
0.2.1

Database specific

last_known_affected_version_range 
"<= 1.2.1"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-fpx8-73gf-7x73/GHSA-fpx8-73gf-7x73.json"