High severity · published Oct 5, 2026
CVE-2026-104892
Plane: Plaintext logging of API token
8.7
CVSS
0.2%
EPSS
No
On KEV
Description
Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user API keys and further escalate their privileges. This issue is fixed in 1.4.0.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PL
plane · makeplane
< 1.4.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-104892
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-104892
x_refsource_CONFIRM
https://github.com/makeplane/plane/security/advisories/GHSA-r5p8-cj3q-38cc
x_refsource_MISC
https://github.com/makeplane/plane/pull/9148
x_refsource_MISC
https://github.com/makeplane/plane/commit/edf247541301e482f2688c63481464b671ec579d
x_refsource_MISC
https://github.com/makeplane/plane/releases/tag/v1.4.0
More from plane
9.9
CVE-2026-105636
Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)
9.8
CVE-2026-105641
Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass
9.8
CVE-2026-105639
Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane
9.6
CVE-2026-105637
Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)
9.1
CVE-2026-105640
Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)