HIGH 8.7 NVD
CVE-2026-104892
Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to st
Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user API keys and further escalate their privileges. This issue is fixed in 1.4.0.
References
- https://github.com/makeplane/plane/commit/edf247541301e482f2688c63481464b671ec579d
- https://github.com/makeplane/plane/pull/9148
- https://github.com/makeplane/plane/releases/tag/v1.4.0
- https://github.com/makeplane/plane/security/advisories/GHSA-r5p8-cj3q-38cc
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-10-05 via NVD.
vulnfeed aggregates 7640 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.