PT-2026-39196 · Plunk · Plunk

Bigbluewhale111 · Published 2026-05-08 · Updated 2026-05-13 · CVE-2026-42193

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Plunk versions prior to 0.9.0

Description The '/webhooks/sns' endpoint accepts Amazon SNS notification payloads from unauthenticated requests without verifying the SNS signature, certificate, or topic ARN. This allows an unauthenticated attacker to forge webhook requests and spoof SNS events to trigger workflow automations, unsubscribe contacts, manipulate email delivery metrics, and potentially exhaust billing credits.

Recommendations Update to version 0.9.0. As a temporary workaround, restrict access to the '/webhooks/sns' endpoint to minimize the risk of exploitation.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2026-42193

Affected Products

Plunk

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-42193 · Security Note
• https://github.com/useplunk/plunk/releases/tag/v0.9.0 · Note
• https://github.com/useplunk/plunk/security/advisories/GHSA-9792-w86v-gx53 · Note
• https://twitter.com/lyrie_ai/status/2054388651329478703 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054388652147376362 · Twitter Post
• https://twitter.com/CVEnew/status/2053131442251874687 · Twitter Post
• https://twitter.com/KaitanSecurity/status/2052878721116168433 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2052983392090620025 · Twitter Post