CVE-2026-42193

CRITICAL 9.1CVE-2026-42193 · Published 08/05/2026 · updated 26/10/2026

In short

CVE-2026-42193 is a CRITICAL (CVSS 9.1) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 0.13%, higher than 2.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, the /webhooks/sns endpoint accepts Amazon SNS notification payloads from unauthenticated requests without verifying the SNS signature, certificate, or topic ARN, meaning anyone can forge a valid-looking webhook request. This allows an unauthenticated attacker to spoof SNS events to trigger workflow automations, unsubscribe contacts, manipulate email delivery metrics, and potentially exhaust billing credits. This issue has been patched in version 0.9.0.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free