CVE-2026-42193: fallo crítico en useplunk plunk
Plunk: SNS webhook forgery
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.1epss 0.1%
Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, the /webhooks/sns endpoint accepts Amazon SNS notification payloads from unauthenticated requests without verifying the SNS signature, certificate, or topic ARN, meaning anyone can forge a valid-looking webhook request. This allows an unauthenticated attacker to spoof SNS events to trigger workflow automations, unsubscribe contacts, manipulate email delivery metrics, and potentially exhaust billing credits. This issue has been patched in version 0.9.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Productos afectados
useplunk · plunkCVEs relacionadas — useplunk plunk
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-32096CRITICALPlunk has SSRF via unvalidated AWS SNS SubscriptionConfirmation in POST /webhooks/snsEPSS 0.3%CVE-2026-34975HIGHPlunk has a CRLF Email Header Injection in raw MIME message construction allows authenticated API user to inject arbitrary email headersEPSS 0.2%CVE-2026-42192MEDIUMPlunk: Stored XSS in campaign viewEPSS 0.2%CVE-2026-32095MEDIUMPlunk has Stored Cross-Site Scripting (XSS) via SVG File UploadEPSS 0.2%