Vulnerability · Published Mar 11, 2026 · Assigned by GitHub_M

CVE-2026-32096Plunk has SSRF via unvalidated AWS SNS SubscriptionConfirmation in POST /webhooks/sns

Critical 9.3

In plain English

A critical-severity server-side request forgery in plunk from useplunk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)9.3Critical

Exploit odds (30 days)0.3%top 75.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.0, a Server-Side Request Forgery (SSRF) vulnerability existed in the SNS webhook handler. An unauthenticated attacker could send a crafted request that caused the server to make an arbitrary outbound HTTP GET request to any host accessible from the server. This vulnerability is fixed in 0.7.0.

Affected products (as reported)

Vendor	Product	Versions
useplunk	plunk	< 0.7.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

References

https://github.com/useplunk/plunk/security/advisories/GHSA-xpqg-p8mp-7g44 x_refsource_CONFIRM
https://github.com/useplunk/plunk/commit/b8f1ad9ab53c78f8ef063fdc125f397c8bfc7652 x_refsource_MISC