CVE-2026-104892 — Plane: Plaintext logging of API token
Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user API keys…
Published: 2026-10-05 · CVSS: 8.7 · CVSS 4.0
Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user API keys and further escalate their privileges. This issue is fixed in 1.4.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7