What is the CVSS score of CVE-2026-42193?

CVE-2026-42193 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Plunk are affected by CVE-2026-42193?

Plunk versions before 0.9.0 contain an unauthenticated webhook spoofing vulnerability that allows remote attackers to forge SNS notification events.. A patch is available.

How to fix or mitigate CVE-2026-42193?

Within 24 hours, inventory your Plunk deployment to confirm which versions are in production and assess exposure scope. Within 7 days, upgrade all instances to Plunk 0.9.0 or later and validate that the SNS webhook endpoint properly validates signatures and topic ARNs. Within 30 days, review CloudTrail and SNS logs for anomalous webhook requests dating to deployment, reconcile AWS SES billing for cost anomalies, and audit unsubscribe records for unexplained customer removals.

Plunk CVE-2026-42193

EUVD-2026-28832 CRITICAL

Improper Verification of Cryptographic Signature (CWE-347)

2026-05-08 GitHub_M

Information Disclosure Jwt Attack Plunk Useplunk

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

9.1 CRITICAL

Unauthenticated network endpoint accepts unsigned payloads (AV:N/AC:L/PR:N/UI:N); forged events corrupt data/automations (I:H) and can exhaust billing/delivery (A:H); no data disclosure (C:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 22:42 vuln.today

Analysis Generated

Jul 23, 2026 - 22:42 vuln.today

Patch available

May 08, 2026 - 23:18 EUVD

CVE Published

May 08, 2026 - 21:12 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, the /webhooks/sns endpoint accepts Amazon SNS notification payloads from unauthenticated requests without verifying the SNS signature, certificate, or topic ARN, meaning anyone can forge a valid-looking webhook request. This allows an unauthenticated attacker to spoof SNS events to trigger workflow automations, unsubscribe contacts, manipulate email delivery metrics, and potentially exhaust billing credits. This issue has been patched in version 0.9.0.

AnalysisAI

Amazon SNS webhook spoofing in Plunk before 0.9.0 lets any unauthenticated remote attacker forge notifications to the /webhooks/sns endpoint because the server never validates the SNS signature, certificate, or topic ARN. Attackers can inject fake email-delivery events to trigger workflow automations, unsubscribe contacts, poison delivery metrics, and drive up AWS SES billing costs. No public exploit identified at time of analysis and EPSS is very low (0.03%), but the flaw is trivially automatable against default deployments.

Technical ContextAI

Plunk is a self-hosted, open-source transactional and marketing email platform that sits on top of AWS Simple Email Service (SES), which delivers bounce/complaint/delivery events via Amazon Simple Notification Service (SNS). SNS messages are meant to be authenticated by verifying the message signature against the X.509 certificate hosted at the SigningCertURL and confirming the TopicArn matches an expected subscription. The root cause is CWE-347 (Improper Verification of Cryptographic Signature): the /webhooks/sns handler processed inbound JSON payloads as trusted without performing any of these checks, so a client-supplied body indistinguishable from a real SNS notification was accepted. The v0.9.0 fix adds this control, evidenced by the release commit 'implement AWS SNS signature verification in SecurityService' (b79d416). The affected package is identified by CPE cpe:2.3:a:useplunk:plunk (all versions prior to 0.9.0).

RemediationAI

Vendor-released patch: upgrade Plunk to version 0.9.0 or later, which implements AWS SNS signature verification in the SecurityService (commit b79d416); see https://github.com/useplunk/plunk/releases/tag/v0.9.0 and the advisory at https://github.com/useplunk/plunk/security/advisories/GHSA-9792-w86v-gx53. If you cannot upgrade immediately, place the /webhooks/sns endpoint behind a network control that only accepts connections from AWS SNS source ranges or a trusted reverse proxy, and add signature/TopicARN validation at that proxy - with the trade-off that AWS publishes broad IP ranges so this is coarse and can break legitimate SNS delivery if misconfigured. As a further stopgap, set AWS billing alarms and SES sending caps to limit the financial blast radius of forged events, and monitor for anomalous unsubscribe or automation activity; these controls reduce impact but do not close the underlying spoofing vector, so upgrading remains the real fix.