CVE-2026-104892

Plane is an open-source project management tool

Risk score: 55/100
CVSS: 8.7 v4.0
Exploit chance (30 days): 0.2%
Published: 5 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user API keys and further escalate their privileges. This issue is fixed in 1.4.0.
Affected: See advisory
Fix: Upgrade the product to 1.4.0 or later.
Exploitation: No known exploitation

Why it is Yellow

CVSS 8.7 high

References

https://github.com/makeplane/plane/commit/edf247541301e482f2688c63481464b671ec579d
https://github.com/makeplane/plane/pull/9148
https://github.com/makeplane/plane/releases/tag/v1.4.0
https://github.com/makeplane/plane/security/advisories/GHSA-r5p8-cj3q-38cc

Original description

Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user API keys and further escalate their privileges. This issue is fixed in 1.4.0.

Last activity 5 Oct 2026. Patch Forecast updates every hour.