---
id: "CVE-2026-111869"
kind: "vulnerability"
aliases: ["CVE-2026-111869"]
title: "Plane: API trusts X-Forwarded-For header in a security decision"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["api", "package", "plane", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2026-10-18T03:16:28+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:14:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111869", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Plane: API trusts X-Forwarded-For header in a security decision

Plane up to version 1.4.2 has an API endpoint that trusts the X-Forwarded-For header as if it were a verified client address. A remote attacker who sets that header can bypass the security check that depends on it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Plane version and whether it is `1.4.2` or earlier
- unknown

## Fix

- Upgrade Plane past `1.4.2` once a fixed release is published
- unknown

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111869

## From the sources

A vulnerability was identified in makeplane plane up to 1.4.2. Impacted is an unknown function of the component API Endpoint. Such manipulation of the argument X-Forwarded-For leads to reliance on untrusted inputs in a security decision. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_