CVE-2026-42193

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-42193

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42193.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-42193

Aliases

GHSA-9792-w86v-gx53

Published

2026-05-08T21:12:26.450Z

Modified

2026-08-12T03:51:45.386852246Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVSS Calculator

Summary

Plunk: SNS webhook forgery

Details

Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, the /webhooks/sns endpoint accepts Amazon SNS notification payloads from unauthenticated requests without verifying the SNS signature, certificate, or topic ARN, meaning anyone can forge a valid-looking webhook request. This allows an unauthenticated attacker to spoof SNS events to trigger workflow automations, unsubscribe contacts, manipulate email delivery metrics, and potentially exhaust billing credits. This issue has been patched in version 0.9.0.

Database specific

{
    "cwe_ids": [
        "CWE-347"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42193.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/useplunk/plunk

Affected ranges

Type

GIT

Repo

https://github.com/useplunk/plunk

Events

Introduced

Fixed

e450ae62a3da4a4fdb5f8e2c04c17bd378a800ca

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.9.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*

v0.1.0

v0.1.1

v0.2.0

v0.4.0

v0.6.0

v0.7.0

v0.8.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42193.json"