Plunk CVE-2026-42193

Exploitation requires only that a Plunk instance older than 0.9.0 expose its /webhooks/sns endpoint to the attacker (typically internet-reachable, as SNS must reach it). No authentication, credentials, user interaction, or non-default configuration is needed - the endpoint accepts unsigned, unverified SNS-shaped payloads by default. The concrete prerequisite is a reachable /webhooks/sns route on an unpatched version; the main limiting factor is network reachability of that endpoint (instances not exposed to untrusted networks, or fronted by a proxy enforcing SNS validation, are not exploitable) and the fact that impact is confined to email-event manipulation, automation abuse, and SES billing exhaustion rather than data disclosure or code execution.

The signals are mixed and worth weighing carefully. CVSS 9.1 (AV:N/AC:L/PR:N/UI:N, C:N/I:H/A:H) reflects that exploitation is network-based, requires no privileges or user interaction, and yields high integrity and availability impact with no confidentiality loss - consistent with event forgery rather than data theft. CISA's SSVC framing agrees on severity of outcome (Technical Impact: total, Automatable: yes) but records Exploitation as 'none', and EPSS is only 0.03% (9th percentile), so there is no evidence of real-world exploitation and the flaw is not in CISA KEV. This is a genuine, easily automated integrity/availability issue that any internet-reachable Plunk instance is exposed to, but the low deployment footprint and absence of observed exploitation put it below actively-exploited enterprise bugs in priority. Note a data-quality conflict: the input tags 'Jwt Attack, Information Disclosure' do not match the actual vulnerability, which involves AWS SNS signature verification (not JWT) and integrity/availability impact (the CVSS vector explicitly sets C:N, so there is no confidentiality/information-disclosure impact) - treat those tags as unreliable.

An attacker who knows a target runs Plunk sends a crafted HTTP POST to the public /webhooks/sns endpoint with a JSON body mimicking an SNS delivery/bounce/complaint notification. Because no signature, certificate, or TopicARN check occurs, Plunk trusts the event and unsubscribes contacts, fires workflow automations, and skews delivery metrics; repeated forged events can also inflate downstream AWS SES/SNS billing. No public POC is identified, but the low complexity (AC:L, no auth) makes scripting the attack straightforward.