CVE-2026-105641

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0

Description Manifests in deployments/aio/community/ and deployments/cli/community/ use fixed, publicly known default values for SECRET KEY and LIVE SERVER SECRET KEY that remain active if not overridden. While the setup.sh script randomizes secrets for the development Docker Compose path, it does not do so for aio and cli community deployments. An attacker with knowledge of SECRET KEY can forge Django-signed values to compromise sessions or accounts. Additionally, knowledge of LIVE SERVER SECRET KEY allows for the bypass of live-service authentication on affected community deployments.

Recommendations Update to version 1.4.0. Override the default SECRET KEY and LIVE SERVER SECRET KEY values with unique, random secrets.