CVE-2026-42193 Plunk: SNS webhook forgery
Unauthenticated attackers can forge SNS webhooks to manipulate email workflows, unsubscribe contacts, and exhaust billing credits in Plunk.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-42193?
CVE-2026-42193 is a critical missing authorization vulnerability in useplunk plunk, published on 8 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, the /webhooks/sns endpoint accepts Amazon SNS notification payloads from unauthenticated requests without verifying the SNS signature, certificate, or topic ARN, meaning anyone can forge a valid-looking webhook request. This allows an unauthenticated attacker to spoof SNS events to trigger workflow automations, unsubscribe contacts, manipulate email delivery metrics, and potentially exhaust billing credits. This issue has been patched in version 0.9.0.
Weakness: CWE-347
Which versions are affected by CVE-2026-42193?
How do I fix CVE-2026-42193?
No fix has been published for CVE-2026-42193 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-42193 being exploited?
There is no known exploitation of CVE-2026-42193 in the wild and no public exploit code.
Sources
Also known as GHSA-9792-w86v-gx53.