CVE-2026-42193

Critical

Published: 08/05/2026(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Plunk is an open-source email platform that, prior to version 0.9.0, did not verify the SNS signature, certificate, or topic ARN for Amazon SNS notifications at the /webhooks/sns endpoint. This allows attackers to forge webhook requests.

Risk Assessment

Unauthenticated attackers can trigger workflow automations, unsubscribe contacts, and manipulate email delivery metrics, potentially exhausting billing credits.

Recommendation

It is recommended to upgrade to version 0.9.0 or later to mitigate these vulnerabilities.

Original NVD description (English source)

Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, the /webhooks/sns endpoint accepts Amazon SNS notification payloads from unauthenticated requests without verifying the SNS signature, certificate, or topic ARN, meaning anyone can forge a valid-looking webhook request. This allows an unauthenticated attacker to spoof SNS events to trigger workflow automations, unsubscribe contacts, manipulate email delivery metrics, and potentially exhaust billing credits. This issue has been patched in version 0.9.0.