CVE-2026-104892

Executive Summary

CVE-2026-104892 is a cleartext storage of sensitive information vulnerability (CWE-256) in Plane, an open-source project management tool. Prior to version 1.4.0, the aPITokenLogMiddleware component logs API keys in plaintext, allowing an attacker with low privileges and access to logs to harvest credentials and escalate privileges. Affected organizations are those self-hosting or consuming Plane versions below 1.4.0 where log output is accessible to non-privileged users or downstream systems.

Technical Analysis

The vulnerability resides in a middleware component named aPITokenLogMiddleware, which is responsible for logging API token activity within the Plane application. According to the NVD description, this middleware writes API keys to log output in plaintext rather than redacting, hashing, or otherwise obfuscating them. This is a classic CWE-256 (Plaintext Storage of a Password) condition applied to API credentials.

The attack surface is the application log stream. Because API tokens are bearer credentials that authenticate a user or service to the Plane API, their exposure in logs effectively discloses authentication material. The flaw does not require remote code execution, injection, or authentication bypass; it is a design and implementation weakness in how the middleware handles sensitive values. Any principal able to read the logs — whether through low-privileged application access, log aggregation pipelines, shared hosting, container stdout, or misconfigured log storage — can recover valid API keys.

No CVSS vector or score was assigned in the provided data; the vector above reflects a reasoned assessment based on network accessibility of the API, low privileges required to reach logs, and high confidentiality impact of exposed credentials. This assessment should be validated by the consuming organization. No public proof-of-concept, Nuclei template, or exploit code was identified in the provided intelligence.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (cleartext credential logging) and the description provided.

1. Reconnaissance / target identification. An attacker identifies a Plane instance running a version prior to 1.4.0. This may be a self-hosted deployment reachable on the network or a cloud instance whose logs are accessible to the attacker through shared infrastructure, log dashboards, or low-privileged application accounts.

2. Triggering the flaw class. The aPITokenLogMiddleware writes API keys to logs in plaintext during normal API token activity. The attacker does not need to craft a malicious request; routine authenticated API usage by legitimate users causes tokens to be emitted to the log stream. The attacker's objective at this stage is simply to obtain read access to those logs.

3. Payload / execution method. At the vulnerability-class level, the "payload" is the captured plaintext API key itself. The attacker extracts the key from the log entry and replays it as a bearer credential against the Plane API. No code execution or memory corruption is involved — this is credential theft via information disclosure.

4. Post-exploitation impact. Possession of a valid API key grants the attacker the privileges associated with the key's owner. Because the description explicitly notes that a low-privileged party can "steal user API keys and further escalate their privileges," the attacker can pivot from a low-privileged position to the authority of any user whose key was logged — including administrators — enabling data access, project manipulation, and further lateral movement within the Plane instance.

Impact Assessment

The confidentiality impact is high: API keys represent direct authentication material, and their exposure enables impersonation of the key owner. The integrity and availability impacts depend on the privileges of the compromised keys — a logged administrator key could permit modification or deletion of projects and data. The scope is unchanged (the vulnerability affects the Plane application and its credential trust domain), and no user interaction is required for the credentials to be logged.

Business impact includes unauthorized access to project management data, potential exposure of sensitive internal roadmaps, issue trackers, and attached files, and downstream compromise of any external systems that reuse or trust the exposed API keys. Blast radius scales with the number of users whose keys transited the logs and with the accessibility of log storage — shared log platforms, centralized SIEM ingestion, and container logging to third-party services materially widen exposure. No CVSS subscores or EPSS value were provided; the values above are analyst-derived and should be treated as provisional.

Detection Guidance

Sigma Rule

title: Plane API Key Exposure in Logs (CVE-2026-104892)
id: 3f9a1c2e-7b4d-4e21-9a6f-0d5e8c1b2a34
status: experimental
description: Detects API key material appearing in Plane application logs, indicating cleartext logging of tokens by aPITokenLogMiddleware prior to 1.4.0.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104892
author: valtersit.com
date: 2026-01-01
logsource:
  product: plane
  service: application
detection:
  keywords:
    - 'aPITokenLogMiddleware'
    - 'api_key'
    - 'apiKey'
    - 'token='
  condition: keywords
falsepositives:
  - Legitimate debug logging during development
level: high

YARA Rule

rule CVE_2026_104892_Plane_Plaintext_Token_Logging
{
    meta:
        description = "Detects plaintext API key logging patterns associated with Plane aPITokenLogMiddleware (CVE-2026-104892)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104892"
        severity = "high"
    strings:
        $mw = "aPITokenLogMiddleware" ascii wide nocase
        $k1 = "api_key" ascii wide nocase
        $k2 = "apikey" ascii wide nocase
        $k3 = "token=" ascii wide nocase
    condition:
        $mw or (2 of ($k*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104892 Plane API Key Cleartext Logging Attempt"; flow:to_server,established; http.uri; content:"/api/"; http.header; content:"Authorization"; content:"Token"; nocase; threshold:type limit, track by_src, count 1, seconds 60; classtype:attempted-recon; sid:2026104892; rev:1;)

Elastic Detection

sequence by host.name
  [process where process.name : "plane" and message : "aPITokenLogMiddleware"]
  [file where file.path : "*.log" and file.Ext? : true]

Splunk SPL Query

index=plane_logs ("aPITokenLogMiddleware" OR "api_key" OR "apikey" OR "token=")
| stats count values(message) as log_evidence by host, source
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="plane,cve-2026-104892,">
  <rule id="104892" level="12">
    <decoded_as>json</decoded_as>
    <field name="message">aPITokenLogMiddleware|api_key|apikey|token=</field>
    <description>CVE-2026-104892: Potential cleartext API key logging in Plane logs</description>
    <mitre>
      <id>T1552</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations: Restrict read access to Plane application logs and any downstream log aggregation systems to the smallest possible set of trusted administrators. Rotate all API keys that may have transited logs on versions prior to 1.4.0. Where possible, disable or reduce verbose logging and sanitize log pipelines to strip token-like values.

2. Patch/upgrade steps: The vulnerability is fixed in Plane 1.4.0. Upgrade to 1.4.0 or later. No vendor advisory or patch reference was identified in the provided intelligence; validate the fixed version against the upstream project release notes before deployment. Post-upgrade, confirm that token values are no longer emitted in logs and rotate any credentials exposed prior to the upgrade.

3. Long-term hardening: Adopt centralized secret redaction in logging middleware, enforce least privilege on log storage, avoid emitting bearer credentials at any log level, and implement credential rotation policies. Monitor logs for accidental secret leakage and integrate secret-scanning into CI/CD.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-104892
• Plane project (upstream): https://github.com/makeplane/plane
• CWE-256: https://cwe.mitre.org/data/definitions/256.html
• MITRE ATT&CK T1552 (Unsecured Credentials): https://attack.mitre.org/techniques/T1552/
• CISA KEV Catalog: not applicable (CVE not listed as of this report)

No public PoC, exploit code, or known threat actor campaign was identified in the provided intelligence.