{"id":"CVE-2026-111869","kind":"vulnerability","aliases":["CVE-2026-111869"],"related":[],"title":"Plane: API trusts X-Forwarded-For header in a security decision","description":"A vulnerability was identified in makeplane plane up to 1.4.2. Impacted is an unknown function of the component API Endpoint. Such manipulation of the argument X-Forwarded-For leads to reliance on untrusted inputs in a security decision. It is possible to launch the attack remotely. The exploit is publicly available and might be used.","summary":"Plane up to version 1.4.2 has an API endpoint that trusts the X-Forwarded-For header as if it were a verified client address. A remote attacker who sets that header can bypass the security check that depends on it.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api","package","plane","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed Plane version and whether it is `1.4.2` or earlier\n- unknown","fix":"- Upgrade Plane past `1.4.2` once a fixed release is published\n- unknown","status":"open","published_at":"2026-10-18T03:16:28+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:14:03+00:00","updated_at":"2026-10-25T04:14:03+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-25T04:14:03Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Plane past `1.4.2` once a fixed release is published\n- unknown","reach":"internet","title":"Plane: API trusts X-Forwarded-For header in a security decision","impact":"medium","summary":"Plane up to version 1.4.2 has an API endpoint that trusts the X-Forwarded-For header as if it were a verified client address. A remote attacker who sets that header can bypass the security check that depends on it.","category":"package","nicknames":[],"who_cares":["self-hosted","plane","api"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Attacker bypasses an IP-based security check on the API","analyst_note":"Find the NVD entry's affected endpoint, the security decision it feeds, and the fixed version at https://nvd.nist.gov/vuln/detail/CVE-2026-111869.","how_to_check":"- Check the installed Plane version and whether it is `1.4.2` or earlier\n- unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams that self-host Plane 1.4.2 or earlier with an API endpoint exposed to the internet or a network. The sources do not say which endpoint or which security decision is affected, so the exposure depends on the deployment. Teams running a later version or not exposing the API can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000582,"input_tokens":3316,"output_tokens":500,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111869':15A,18A '-2026':14A,17A '1.4.2':29B,73C 'address':49B 'api':2A,19B,32B,82C 'argument':88C 'attack':52B,109C 'avail':115C 'bypass':58B 'check':61B 'client':48B 'compon':81C 'cve':13A,16A 'decis':12A,102C 'depend':63B 'endpoint':33B,83C 'exploit':112C 'forward':6A,39B,91C 'function':78C 'header':8A,41B,56B 'host':24B 'identifi':67C 'impact':74C 'input':98C 'launch':107C 'lead':93C 'makeplan':69C 'manipul':85C 'might':117C 'packag':20B 'plane':1A,21B,25B,70C 'possibl':105C 'public':114C 'relianc':95C 'remot':51B,110C 'secur':11A,60B,101C 'self':23B 'self-host':22B 'set':54B 'trust':3A,35B 'unknown':77C 'untrust':97C 'use':119C 'verifi':47B 'version':28B 'vulner':65C 'x':5A,38B,90C 'x-forwarded-for':4A,37B,89C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Plane 1.4.2 or earlier with an API endpoint exposed to the internet or a network. The sources do not say which endpoint or which security decision is affected, so the exposure depends on the deployment. Teams running a later version or not exposing the API can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T03:16:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111869","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111869","severity":null,"published_at":"2026-10-18T03:16:28+00:00","modified_at":"2026-10-22T03:16:31+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}