CVE Intelligence
Analysis AI-assisted

CVE-2026-42193: Plunk: Missing SNS Webhook Signature Verification

Plunk versions before 0.9.0 accept Amazon SNS notification payloads at the /webhooks/sns endpoint without verifying the SNS signature, certificate, or topic ARN. The advisory describes this as allowing unauthenticated spoofing of SNS events, which can affect workflows, contacts, delivery metrics, and billing. The issue is fixed in version 0.9.0, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Plunk is an open-source email platform built on AWS SES. According to the record, versions prior to 0.9.0 expose a /webhooks/sns endpoint that accepts Amazon SNS notification payloads without verifying the SNS signature, certificate, or topic ARN. The weakness is classified as CWE-347, Improper Verification of Cryptographic Signature.

Impact

  • Forged webhook requests can appear valid to the application.
  • The description lists possible effects: triggering workflow automations, unsubscribing contacts, manipulating email delivery metrics, and potentially exhausting billing credits.
  • The record reports a CVSS 3.1 score of 9.1 (critical) from the GitHub CNA. The recorded vector indicates no confidentiality impact and high integrity and availability impact.

Affected products and versions

  • Product: Plunk (useplunk/plunk).
  • Versions: prior to 0.9.0, according to the description.
  • The structured affected and fixes fields in the record are empty. This is a data gap, not evidence that no versions are affected.
  • Fixed in 0.9.0 according to the description and the release page.

Exploitation status

CISA KEV does not list this CVE. No confirmed exploitation appears in the sources consulted. The record shows an EPSS probability of 0.00205 with a percentile of 0.0971.

Remediation and mitigation

  • Upgrade Plunk to version 0.9.0 or later.
  • Review the GitHub security advisory for maintainer guidance.
  • Until the upgrade is applied, limit public exposure of the webhook endpoint where operationally feasible. This is a defensive suggestion based on the description.
  • Review recent workflow runs, unsubscribe events, and delivery metrics for anomalies that could indicate spoofed events.

Detection guidance

  • Monitor webhook endpoint logs for SNS-style requests that do not correspond to expected SES activity.
  • Compare event volumes recorded by the application with those in the AWS SES console to identify discrepancies.
  • Watch for unexpected spikes in unsubscribes, bounces, or complaint metrics.

Limitations of the available information

  • The record does not include structured affected or fixed version data.
  • It does not describe affected deployments, proof-of-concept details, or whether any incident has occurred.
  • The CVSS data comes from the GitHub CNA record. The record does not include a separate NVD score.
  • The record gives a publication date of 2026-05-08.

Frequently asked questions

Is this Plunk vulnerability being actively exploited?

CISA KEV does not list CVE-2026-42193, and no confirmed exploitation appears in the sources consulted.

Which version fixes the issue?

According to the description and the release page, version 0.9.0 contains the fix. Earlier versions are described as affected.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.