Vulnerability · Published Jul 28, 2026 · Assigned by VulnCheck

CVE-2026-57511SuperPlane < 0.30.0 SMTP Header Injection via Webhook Event Title

Medium 5.4

In plain English

A medium-severity security flaw in superplane from superplanehq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.4%top 65.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows unauthenticated attackers to inject arbitrary SMTP headers by including CRLF sequences in the event payload title field delivered via webhook. Attackers can manipulate the unsanitized title field passed to the SMTP DATA command to add Bcc recipients for content exfiltration, forge the From address to bypass SPF and DKIM checks, or inject Content-Type and MIME boundary headers to corrupt message bodies for phishing.

Affected products (as reported)

Vendor	Product	Versions
superplanehq	superplane	0 – before 0.30.0

Weakness: CWE-93 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

References

Release Notes release-notes
Pull Request issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/superplane-smtp-header-injection-via-webhook-event-title third-party-advisory