Plane Project Management Tool API Key Exposure via Plaintext Logging

Executive Summary

CVE-2026-104892 is a vulnerability in the Plane project management tool where the APITokenLogMiddleware logs API keys in plaintext. This affects versions up to 1.3.1. Low-privileged users can steal these API keys from logs and potentially escalate their privileges. The issue is fixed in version 1.4.0.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check Plane application logs for plaintext API keys in the file plane/apps/api/plane/middleware/logger.py. Search logs for X-Api-Key, Authorization headers, or Cookie values stored in plaintext. Use commands like grep -r 'X-Api-Key' /path/to/logs or grep -r 'Authorization:' /path/to/logs to identify exposed keys.

Useful 0 Not Useful 0

Impact Analysis

An attacker with low privileges could steal API keys from logs and use them to access sensitive data or perform unauthorized actions. This could lead to further privilege escalation within the Plane application or compromise of connected services using the stolen API keys.

Useful 0 Not Useful 0

Compliance Impact

Logging API keys in plaintext violates data protection principles by exposing sensitive credentials. This could lead to non-compliance with GDPR (data breaches) and HIPAA (unauthorized access to protected health information) due to inadequate protection of authentication tokens.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Plane to version 1.4.0 or later to address the plaintext API key logging issue. Review and redact any logs containing API keys. Ensure API tokens are stored as SHA-256 hashes instead of plaintext. Remove MongoDB as a log sink and migrate logs to PostgreSQL.

Useful 0 Not Useful 0