CVE-2026-42193: Plunk Email Platform Auth Bypass Flaw

CVE-2026-42193 Overview

CVE-2026-42193 affects Plunk, an open-source email platform built on top of Amazon Simple Email Service (SES). The /webhooks/sns endpoint in versions prior to 0.9.0 accepts Amazon Simple Notification Service (SNS) payloads without verifying the SNS signature, certificate, or topic Amazon Resource Name (ARN). An unauthenticated remote attacker can forge SNS notifications and submit them directly to the endpoint. Successful forgery allows attackers to trigger workflow automations, unsubscribe contacts, manipulate email delivery metrics, and exhaust AWS billing credits. The flaw maps to [CWE-347: Improper Verification of Cryptographic Signature]. Plunk version 0.9.0 introduces signature validation to remediate the issue.

Critical Impact

Unauthenticated attackers can forge SNS webhook requests to manipulate email workflows, corrupt delivery metrics, and exhaust AWS billing credits.

Affected Products

• Plunk (open-source email platform) versions prior to 0.9.0
• Plunk deployments integrated with AWS SES and SNS notifications
• Self-hosted Plunk instances exposing the /webhooks/sns endpoint to the internet

Discovery Timeline

• 2026-05-08 - CVE-2026-42193 published to the National Vulnerability Database (NVD)
• 2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-42193

Vulnerability Analysis

Plunk integrates with AWS SES through Amazon SNS notifications that report bounces, complaints, and deliveries. The /webhooks/sns handler in Plunk versions before 0.9.0 processes inbound SNS payloads as trusted input. The handler omits validation of the Signature and SigningCertURL fields contained within SNS messages. It also fails to confirm that the originating TopicArn matches an expected, configured value.

An attacker who knows or guesses the public webhook URL can submit a crafted JSON body that mimics a legitimate SNS Notification. The application then processes the forged event as authentic. Downstream effects include modification of contact subscription state, distortion of campaign analytics, and execution of automated workflows tied to email events. Repeated forged events can also drive outbound API calls that consume AWS billing credits.

Root Cause

The root cause is missing cryptographic signature verification on inbound SNS notifications. AWS publishes a signing certificate and signature with every SNS message so consumers can validate authenticity. Plunk did not perform this validation, and it did not enforce an allowlist of trusted SNS topic ARNs.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends an HTTP POST request containing a forged SNS Notification payload to the publicly reachable /webhooks/sns endpoint. No credentials, user interaction, or prior access are required.

No verified proof-of-concept code is published. Refer to the GitHub Security Advisory GHSA-9792-w86v-gx53 for additional technical context.

Detection Methods for CVE-2026-42193

Indicators of Compromise

• Inbound POST requests to /webhooks/sns originating from IP addresses outside the published AWS SNS IP ranges.
• SNS payloads with SigningCertURL values that do not resolve to *.amazonaws.com hosts.
• Sudden spikes in unsubscribe events, bounce notifications, or workflow triggers without matching SES activity in CloudWatch.
• Mismatches between Plunk-recorded delivery metrics and the corresponding AWS SES sending statistics.

Detection Strategies

• Inspect web server and application logs for POST requests to /webhooks/sns and correlate source IPs against AWS-published ranges.
• Compare Plunk event volume with AWS SES and SNS topic delivery counts to identify forged events.
• Alert on SNS payloads missing or containing malformed Signature, SignatureVersion, or SigningCertURL fields.

Monitoring Recommendations

• Enable verbose request logging on the reverse proxy fronting Plunk and ship logs to a centralized SIEM.
• Monitor AWS billing metrics and CloudWatch alarms for unexplained increases in SES or SNS activity.
• Track contact subscription state changes and flag bulk unsubscribe events triggered by webhook activity.

How to Mitigate CVE-2026-42193

Immediate Actions Required

• Upgrade all Plunk deployments to version 0.9.0 or later, which enforces SNS signature verification.
• Restrict access to the /webhooks/sns endpoint at the network or reverse-proxy layer to AWS SNS IP ranges until patching is complete.
• Audit recent contact, workflow, and metric activity for evidence of forged SNS events.

Patch Information

The fix is included in Plunk 0.9.0. The release adds verification of the SNS message signature, certificate chain, and originating topic ARN. Release notes are available in the GitHub Release v0.9.0 and the GitHub Security Advisory GHSA-9792-w86v-gx53.

Workarounds

• Place the /webhooks/sns endpoint behind an allowlist that accepts traffic only from AWS SNS IP ranges.
• Terminate the webhook at a proxy or AWS Lambda function that validates the SNS signature before forwarding to Plunk.
• Rotate any AWS credentials or API keys that may have been abused through forged workflow triggers.

# Example nginx allowlist restricting /webhooks/sns to AWS SNS source ranges
location /webhooks/sns {
    # Replace with current AWS SNS prefixes from ip-ranges.json
    allow 54.240.0.0/18;
    allow 52.94.0.0/16;
    deny all;
    proxy_pass http://plunk_upstream;
}