CVE-2026-32096CWE-918

Plunk has SSRF via unvalidated AWS SNS SubscriptionConfirmation in POST /webhooks/sns

Critical · published March 11, 2026

CVSS v3.1
9.3
EPSS
0%
Percentile
37.8
In the wild
Unconfirmed
What it is

Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.0, a Server-Side Request Forgery (SSRF) vulnerability existed in the SNS webhook handler. An unauthenticated attacker could send a crafted request that caused the server to make an arbitrary outbound HTTP GET request to any host accessible from the server. This vulnerability is fixed in 0.7.0.

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00446 · 37.8th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-03-11T19:53Z
EPSS history
Timeline
  • 11 MAR 19:53Z
    Plunk has SSRF via unvalidated AWS SNS SubscriptionConfirmation in POST /webhooks/sns
    cvelistv5