Is there a patch available for CVE-2026-57511?

Yes, a patch is available for CVE-2026-57511. Update the affected software to the latest version immediately.

SuperPlane CVE-2026-57511

Q: What is the CVSS score of CVE-2026-57511?

CVE-2026-57511 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-49996 MEDIUM

Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)

2026-07-28 VulnCheck

GHSA-c3mp-rj38-mpvh

Authentication Bypass Superplane

6.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network attack vector, low complexity, no privileges; scope changed due to impact on email recipients; low confidentiality/integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 28, 2026 - 19:51 vuln.today

Analysis Generated

Jul 28, 2026 - 19:51 vuln.today

DescriptionCVE.org

SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows unauthenticated attackers to inject arbitrary SMTP headers by including CRLF sequences in the event payload title field delivered via webhook. Attackers can manipulate the unsanitized title field passed to the SMTP DATA command to add Bcc recipients for content exfiltration, forge the From address to bypass SPF and DKIM checks, or inject Content-Type and MIME boundary headers to corrupt message bodies for phishing.

AnalysisAI

SMTP header injection in SuperPlane allows unauthenticated attackers to inject arbitrary SMTP headers via CRLF sequences in webhook event payload titles, enabling email spoofing (bypassing SPF/DKIM), content manipulation, and data exfiltration via Bcc. No public exploit identified at time of analysis; patch available in v0.30.0.

Technical ContextAI

The vulnerability stems from improper neutralization of CRLF sequences (CWE-93) in the event payload title field processed by the SMTP module. When SuperPlane sends an email via SMTP after receiving a webhook event, the unsanitized title is included in the SMTP DATA command. Attackers can insert CRLF characters to break out of the intended header structure and inject arbitrary headers such as Bcc, From, or Content-Type. The affected product is SuperPlane, a workflow automation platform; all versions before 0.30.0 are vulnerable according to the vendor CPE: cpe:2.3:a:superplanehq:superplane:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to SuperPlane v0.30.0, which patches the CRLF injection by sanitizing the event payload title. The fix is in commit 428c559dd2fa0aef3ba825a434a1b05c9abc7df7. If immediate upgrade is not possible, restrict webhook endpoints to trusted sources only (e.g., via API keys or network allowlisting) and disable SMTP notifications if not essential. Note that webhook restrictions may break legitimate integrations.