CVE-2026-105641

Executive Summary

CVE-2026-105641 is a critical hardcoded credentials vulnerability in Plane, an open-source project management tool, affecting versions prior to 1.4.0. The deployments/aio/community/ and deployments/cli/community/ manifests ship with fixed, publicly known default values for SECRET_KEY and LIVE_SERVER_SECRET_KEY that persist unless operators manually override them. With a CVSS score of 9.8, successful exploitation allows attackers to forge Django-signed session values—enabling account takeover—and to bypass live-service authentication on unmodified community deployments.

Technical Analysis

The vulnerability is classified as CWE-798: Use of Hard-coded Credentials. Plane's deployment manifests for the aio/community and cli/community paths include static, publicly documented default values for two security-critical secrets: SECRET_KEY and LIVE_SERVER_SECRET_KEY.

SECRET_KEY is the cryptographic key Django uses to sign session cookies, password reset tokens, and other security-sensitive values. When this key is publicly known and unchanged, an attacker can independently compute valid signatures for arbitrary values. This undermines the integrity guarantees of Django's signing mechanism: any value the application trusts because it is signed (such as a session identifier or authentication token) can be forged by anyone possessing the key.

LIVE_SERVER_SECRET_KEY governs authentication for Plane's live-service component. A publicly known value allows an attacker to authenticate to that service without legitimate credentials.

The root cause of the missing protection is an inconsistency in the project's setup tooling: the top-level setup.sh script randomizes secrets only for the development Docker Compose path. The aio and cli community deployment paths are left untouched, so operators who deploy via those manifests and do not manually override the secrets retain the shared, publicly known production values. Because the defaults are fixed and published, they are not secret in any meaningful sense.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-798) and the NVD description.

1. Reconnaissance / target identification. An attacker identifies internet-facing Plane instances running a community deployment (aio or cli) that has not overridden the default secrets. Because the default secret values are publicly known (shipped in the open-source repository), recon reduces to locating a vulnerable Plane instance rather than extracting a secret.

2. Triggering the flaw class. The attacker does not need to exploit a memory-safety or injection bug. The vulnerability is triggered simply by the presence of the unchanged hardcoded SECRET_KEY/LIVE_SERVER_SECRET_KEY. The attacker uses knowledge of the known SECRET_KEY to construct values signed with that key.

3. Payload / execution at the vulnerability-class level. Using the publicly known SECRET_KEY, the attacker forges Django-signed values (for example, a signed session or authentication token) that the application accepts as authentic. Separately, using the known LIVE_SERVER_SECRET_KEY, the attacker authenticates to the live-service component, bypassing its authentication on unchanged community deployments. No injection payload is required—exploitation is a direct consequence of the credentials being publicly known.

4. Post-exploitation impact. Successful forgery of Django-signed values enables account compromise and session hijacking (the description states knowledge of SECRET_KEY "enables attackers to forge Django-signed values and compromise accounts or sessions"). Bypassing live-service authentication via LIVE_SERVER_SECRET_KEY grants unauthorized access to the live-service functionality. Given the CVSS rating (Confidentiality/Integrity/Availability all High), impact spans data exposure, unauthorized modification, and potential service disruption.

No widespread exploitation or named threat-actor campaign has been publicly attributed to this CVE as of the data provided.

Impact Assessment

CVSS 3.1 base score is 9.8 (Critical): AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The attack is network-reachable, requires no privileges and no user interaction, and yields High impact across confidentiality, integrity, and availability.

Affected systems are Plane community deployments using the deployments/aio/community/ or deployments/cli/community/ manifests on versions before 1.4.0 where operators have not overridden the default secrets. The blast radius is potentially full compromise of the application's authentication model: forged sessions and account takeover affect all user accounts reachable through those sessions, and bypassed live-service authentication exposes that service to unauthenticated access. Organizations running Plane as an internal or externally reachable project-management platform should treat any unmodified community deployment as compromised-credential-prone.

Detection Guidance

Sigma Rule

title: Plane Community Deployment Authentication Anomaly (CVE-2026-105641)
id: 8f4c1e2a-3b7d-4c9e-a1f2-plane105641
status: experimental
description: Detects anomalous authentication events consistent with forged Django-signed sessions or live-service auth bypass on Plane community deployments.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105641
author: valtersit.com
logsource:
  product: plane
  service: application
detection:
  selection_session:
    event:
      - 'session.created'
      - 'user.login'
    session_signed: true
  selection_live:
    component: 'live-service'
    auth_result: 'success'
  filter_known_admin:
    user_role: 'admin'
    src_ip: 'INTERNAL_RANGE_PLACEHOLDER'
  condition: (selection_session or selection_live) and not filter_known_admin
fields:
  - user
  - src_ip
  - event
falsepositives:
  - Legitimate logins from new but authorized administrator sources
level: high
tags:
  - attack.t1190
  - cve.2026.105641

YARA Rule

rule CVE_2026_105641_Plane_Hardcoded_Secrets
{
    meta:
        description = "Detects references to known default SECRET_KEY / LIVE_SERVER_SECRET_KEY values in Plane community deployment manifests"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105641"
        date = "2026-01-01"
    strings:
        $a = "SECRET_KEY" ascii nocase
        $b = "LIVE_SERVER_SECRET_KEY" ascii nocase
        $p1 = "deployments/aio/community" ascii
        $p2 = "deployments/cli/community" ascii
    condition:
        filesize < 2MB and ($a or $b) and ($p1 or $p2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105641 Plane live-service authentication bypass attempt"; flow:to_server,established; http.header; content:"LIVE_SERVER_SECRET_KEY"; nocase; sid:2026105641; rev:1; reference:cve,2026-105641; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105641; classtype:attempted-admin;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where network.protocol == "http" and process.name == "plane" ]
  [ authentication where event.outcome == "success" and service.name == "plane-live-service" and not source.ip in ("10.0.0.0/8","192.168.0.0/16","172.16.0.0/12") ]

Splunk SPL Query

index=plane sourcetype=plane:app
(event="session.created" OR event="user.login" OR (component="live-service" AND auth_result="success"))
| stats count values(user) as users values(src_ip) as src_ips by event host
| where count > 0
| search NOT src_ip IN ("10.0.0.0/8","192.168.0.0/16","172.16.0.0/12")

Wazuh OSSEC Rule

<group name="plane,cve-2026-105641,">
  <rule id="105641" level="12">
    <decoded_as>json</decoded_as>
    <field name="event">session\.created|user\.login</field>
    <description>CVE-2026-105641: Anomalous Plane authentication event - possible forged Django-signed session on community deployment.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>authentication_failed,pci_dss_10.2.4,</group>
  </rule>
  <rule id="105642" level="13">
    <decoded_as>json</decoded_as>
    <field name="component">live-service</field>
    <field name="auth_result">success</field>
    <description>CVE-2026-105641: Plane live-service authentication bypass - possible use of known LIVE_SERVER_SECRET_KEY.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Override SECRET_KEY and LIVE_SERVER_SECRET_KEY in all deployments/aio/community/ and deployments/cli/community/ deployments with high-entropy, unique random values. Do not rely on manifest defaults.
   • Rotate both secrets immediately if there is any chance a community deployment ran with the defaults; invalidate existing sessions after rotation since old signed values are no longer trustworthy.
   • Restrict network exposure of Plane instances and live-service endpoints where operationally feasible.

2. Patch / upgrade steps

   • Upgrade Plane to version 1.4.0, which the description states fixes the issue. Verify that the upgrade path forces or randomizes the secrets for aio and cli community deployments, and confirm secrets are no longer the published defaults after upgrade.

3. Long-term hardening

   • Adopt secrets management (externalized secret stores / environment injection) rather than values baked into deployment manifests.
   • Implement deployment-time validation that refuses to start when known default secrets are detected.
   • Extend setup.sh secret randomization consistently to all deployment paths (aio, cli, and development), so no path ships shared production secrets.
   • Add monitoring for anomalous authentication events to detect forged-session activity.

References

• NVD — https://nvd.nist.gov/vuln/detail/CVE-2026-105641
• Plane project repository and deployment manifests (upstream open-source project; aio/cli community deployment paths)
• Plane version 1.4.0 release (fix version per NVD description)
• CWE-798: Use of Hard-coded Credentials — https://cwe.mitre.org/data/definitions/798.html
• CISA KEV: No — CVE-2026-105641 is not listed in the CISA Known Exploited Vulnerabilities catalog as of this report.

No public PoC, exploit code, or named threat-actor campaign has been identified for this CVE in the provided data.