CVE-2026-32096 Plunk has SSRF via unvalidated AWS SNS SubscriptionConfirmation in POST /webhooks/sns

Critical 9.3 Published 11 Mar 2026 Updated 12 Mar 2026

An unauthenticated attacker can trigger arbitrary outbound HTTP requests via the SNS webhook handler, potentially accessing internal resources.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-32096?

CVE-2026-32096 is a critical server-side request forgery vulnerability in useplunk plunk, published on 11 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.0, a Server-Side Request Forgery (SSRF) vulnerability existed in the SNS webhook handler. An unauthenticated attacker could send a crafted request that caused the server to make an arbitrary outbound HTTP GET request to any host accessible from the server. This vulnerability is fixed in 0.7.0.

Weakness: CWE-918

Which versions are affected by CVE-2026-32096?

It affects 1 product.

Products include Useplunk Plunk.

How do I fix CVE-2026-32096?

No fix has been published for CVE-2026-32096 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-32096 being exploited?

There is no known exploitation of CVE-2026-32096 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-xpqg-p8mp-7g44.