CVE-2026-104973

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0

Description An issue exists where webhook IP addresses are only validated during the creation process in apps/api/plane/app/serializers/webhook.py. The delivery task in apps/api/plane/bgtasks/webhook task.py performs a separate DNS resolution when sending the request without validating the resolved IP address. This allows for DNS rebinding, a technique used to bypass Server-Side Request Forgery (SSRF) protections by changing the DNS record to point to a different IP address after the initial validation.

Recommendations Update to version 1.4.0.