Live › vulnerability › CVE-2026-111869
Go to dashboardPlane up to version 1.4.2 has an API endpoint that trusts the X-Forwarded-For header as if it were a verified client address. A remote attacker who sets that header can bypass the security check that depends on it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that self-host Plane 1.4.2 or earlier with an API endpoint exposed to the internet or a network. The sources do not say which endpoint or which security decision is affected, so the exposure depends on the deployment. Teams running a later version or not exposing the API can skip it.
No product ranges from the sources yet.
1.4.2 or earlier1.4.2 once a fixed release is publishedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was identified in makeplane plane up to 1.4.2. Impacted is an unknown function of the component API Endpoint. Such manipulation of the argument X-Forwarded-For leads to reliance on untrusted inputs in a security decision. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
This page as .md · .json · in your agent: get_signal("CVE-2026-111869")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.