Superplane
Monthly
SuperPlane before 0.27.0 allows authenticated viewers to bypass organization scoping via the CanvasService gRPC handler, accessing and manipulating resources across tenants without authorization. Attackers can read execution histories and event payloads containing secrets, inject queue items or canvas events, and delete canvases in other organizations. No public exploit is known and it is not reported in the CISA KEV catalog at this time.
SMTP header injection in SuperPlane allows unauthenticated attackers to inject arbitrary SMTP headers via CRLF sequences in webhook event payload titles, enabling email spoofing (bypassing SPF/DKIM), content manipulation, and data exfiltration via Bcc. No public exploit identified at time of analysis; patch available in v0.30.0.
SuperPlane before 0.27.0 allows authenticated viewers to bypass organization scoping via the CanvasService gRPC handler, accessing and manipulating resources across tenants without authorization. Attackers can read execution histories and event payloads containing secrets, inject queue items or canvas events, and delete canvases in other organizations. No public exploit is known and it is not reported in the CISA KEV catalog at this time.
SMTP header injection in SuperPlane allows unauthenticated attackers to inject arbitrary SMTP headers via CRLF sequences in webhook event payload titles, enabling email spoofing (bypassing SPF/DKIM), content manipulation, and data exfiltration via Bcc. No public exploit identified at time of analysis; patch available in v0.30.0.