VYPR
← All advisories
Critical severity9.3NVD Advisory· Published Mar 11, 2026· Updated Jun 17, 2026

CVE-2026-32096

CVE-2026-32096

Description

Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.0, a Server-Side Request Forgery (SSRF) vulnerability existed in the SNS webhook handler. An unauthenticated attacker could send a crafted request that caused the server to make an arbitrary outbound HTTP GET request to any host accessible from the server. This vulnerability is fixed in 0.7.0.

Affected products

3
  • Useplunk/Plunk3 versions
    cpe:2.3:a:useplunk:plunk:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:useplunk:plunk:*:*:*:*:*:*:*:*range: <0.7.0
    • (no CPE)range: <0.7.0
    • (no CPE)range: < 0.7.0

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.