CVE-2026-105641 makeplane CVE debrief

Who should care

Operators of Plane's aio/cli community deployments, security teams, and developers using Plane for project management should review and override the SECRET_KEY and LIVE_SERVER_SECRET_KEY configurations to prevent session forgery and live-server auth bypass. They should prioritize upgrading to version 1.4.0 or later and verifying their SECRET_KEY and LIVE_SERVER_SECRET_KEY configurations.

Why it matters

CVE-2026-105641 is a critical vulnerability in Plane's aio/cli community deployments, allowing attackers to forge signed values and bypass authentication. Operators should prioritize upgrading to version 1.4.0 or later and verifying their SECRET_KEY and LIVE_SERVER_SECRET_KEY configurations.

• Session forgery and account compromise
• Live-server authentication bypass
• Potential for lateral movement and unauthorized access

Technical summary

Plane's aio/cli community deployments shipped with hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY, enabling attackers to forge Django-signed values and compromise accounts or sessions, and bypass live-service authentication. The vendor, makeplane, has released a fix in version 1.4.0. Operators should prioritize upgrading to version 1.4.0 or later and verifying their SECRET_KEY and LIVE_SERVER_SECRET_KEY configurations. This critical vulnerability allows attackers to forge Django-signed values and compromise accounts or sessions, and bypass live-service authentication.

Defensive priority

Operators of Plane's aio/cli community deployments should prioritize upgrading to version 1.4.0 or later and verifying their SECRET_KEY and LIVE_SERVER_SECRET_KEY configurations.

Recommended defensive actions

• Upgrade to Plane version 1.4.0 or later
• Verify and override SECRET_KEY and LIVE_SERVER_SECRET_KEY configurations
• Monitor for potential session forgery and live-server auth bypass attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the hardcoded secrets in Plane's aio/cli community deployments. The vendor, makeplane, has released a fix in version 1.4.0. Knowledge of SECRET_KEY enables attackers to forge Django-signed values and compromise accounts or sessions. Knowledge of LIVE_SERVER_SECRET_KEY bypasses live-service authentication on unchanged community deployments. Operators of Plane's aio/cli community deployments, security teams, and developers using Plane for project management should review and override the

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.