What is the CVSS score of CVE-2026-32096?

CVE-2026-32096 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Plunk are affected by CVE-2026-32096?

Plunk email platform versions up to 0.7.0 contain a critical server-side request forgery vulnerability (CVSS 9.3) that could allow attackers to bypass security controls and access internal systems or…

How to fix or mitigate CVE-2026-32096?

Within 24 hours: Identify all instances running Plunk version 0.7.0 or earlier and isolate them from production networks if possible; disable external access to affected instances and document inventory. Within 7 days: Implement network segmentation to restrict Plunk instances from accessing internal systems, AWS metadata endpoints, and sensitive services; deploy WAF rules to block suspicious request patterns. Within 30 days: Upgrade to Plunk version 0.7.1 or later once available; if upgrade is not feasible, evaluate alternative email solutions or implement comprehensive air-gapping of affected systems.

Plunk CVE-2026-32096

CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-11 security-advisories@github.com

SSRF Plunk Useplunk

9.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:07 vuln.today

CVE Published

Mar 11, 2026 - 20:16 nvd

CRITICAL 9.3

DescriptionGitHub Advisory

Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.0, a Server-Side Request Forgery (SSRF) vulnerability existed in the SNS webhook handler. An unauthenticated attacker could send a crafted request that caused the server to make an arbitrary outbound HTTP GET request to any host accessible from the server. This vulnerability is fixed in 0.7.0.