CVE-2026-57511: SuperPlane SMTP Header Injection Flaw

CVE-2026-57511 Overview

CVE-2026-57511 is an SMTP header injection vulnerability in SuperPlane versions before 0.30.0. The flaw resides in the webhook event payload processing logic, where the title field is passed unsanitized to the SMTP DATA command. Unauthenticated attackers can embed carriage return and line feed (CRLF) sequences into the title field to inject arbitrary SMTP headers. This enables silent recipient injection through Bcc, sender spoofing to bypass Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) validation, and MIME boundary manipulation for phishing payload delivery. The vulnerability is tracked under [CWE-93] (Improper Neutralization of CRLF Sequences).

Critical Impact
Unauthenticated remote attackers can inject SMTP headers via webhook payloads, enabling content exfiltration through hidden Bcc recipients and phishing through forged sender addresses.

Affected Products

SuperPlane versions prior to 0.30.0
SuperPlane deployments processing webhook events that trigger email notifications
Any downstream systems consuming SMTP messages generated from SuperPlane webhook events

Discovery Timeline

2026-07-28 - CVE-2026-57511 published to the National Vulnerability Database (NVD)
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-57511

Vulnerability Analysis

SuperPlane accepts webhook event payloads containing a title field that is subsequently used to construct outbound SMTP messages. The vulnerable code path passes the raw title value into the SMTP DATA section without filtering CRLF (\r\n) sequences. Because SMTP relies on CRLF as the delimiter between headers and between the header block and message body, unfiltered user input at this layer allows an attacker to terminate the current header and inject new ones.

Exploitation requires only the ability to deliver a webhook payload to a SuperPlane instance. The attacker does not need authentication, elevated privileges, or user interaction on the receiving end. Successful injection produces mail traffic that appears to originate from the legitimate SuperPlane deployment.

Root Cause

The root cause is missing input neutralization on the title field prior to concatenation into SMTP header lines. Any CRLF sequence embedded in the title terminates the current SMTP header and starts a new one under attacker control. There is no allowlist, escaping, or line-folding logic applied before the value reaches the mail transport layer.

Attack Vector

An attacker sends a crafted webhook to the SuperPlane endpoint with a title value containing CRLF sequences followed by attacker-controlled headers. Common exploitation patterns include:

Injecting Bcc: headers to silently copy outbound mail to attacker-controlled inboxes for exfiltration.
Overriding the From: header to forge sender identity and bypass SPF and DKIM alignment checks at the receiver.
Inserting Content-Type: and --boundary MIME markers to replace the legitimate message body with phishing content.

Because SuperPlane emits the message, downstream mail servers apply the sending domain's SPF and DKIM signatures to the forged content, lending phishing messages the legitimacy of a trusted sender.

No public exploit code has been released. The upstream fix is documented in pull request #6354 and the corresponding remediation commit. See the VulnCheck advisory for additional technical detail.

Detection Methods for CVE-2026-57511

Indicators of Compromise

Outbound SMTP messages originating from SuperPlane hosts that contain multiple From:, Bcc:, or Content-Type: headers.
Webhook request bodies where the title field contains %0d%0a, \r\n, or raw CR/LF byte sequences.
Mail server logs showing unexpected recipient addresses appended to notifications generated by SuperPlane.
SPF or DKIM authentication results reporting anomalies for domains hosting SuperPlane.

Detection Strategies

Inspect ingress webhook payloads at the reverse proxy or WAF for CRLF encoded sequences in JSON string fields.
Correlate SuperPlane application logs with SMTP relay logs to identify outbound mail whose recipient list diverges from the intended notification target.
Alert on outbound messages from SuperPlane hosts with more than one From header or with a Bcc header set from webhook-triggered flows.

Monitoring Recommendations

Enable structured logging of the raw title field in webhook processing and forward to a central analytics pipeline.
Deploy DMARC reporting for the sending domain to capture SPF and DKIM failures indicating spoofing attempts downstream.
Monitor SuperPlane version banners across environments to identify hosts still running versions earlier than 0.30.0.

How to Mitigate CVE-2026-57511

Immediate Actions Required

Upgrade SuperPlane to version 0.30.0 or later. Refer to the v0.30.0 release notes.
Restrict inbound webhook endpoints to authenticated senders using HMAC signatures or mutual TLS where the deployment supports it.
Audit recent outbound SMTP traffic from SuperPlane hosts for anomalous recipients or forged sender addresses.

Patch Information

The fix ships in SuperPlane 0.30.0. The remediation is applied in the upstream repository via pull request #6354 and merged in commit 428c559. Operators running container images or Helm charts should pin to the patched tag and redeploy.

Workarounds

Place SuperPlane behind a web application firewall rule that rejects webhook payloads containing raw or URL-encoded CRLF sequences in string fields.
Route outbound SMTP through a relay that strips duplicate From, Bcc, and Content-Type headers before delivery.
Temporarily disable webhook-triggered email notifications until the upgrade to 0.30.0 is deployed.

bash

# Example WAF rule (ModSecurity) blocking CRLF in webhook title fields
SecRule REQUEST_URI "@beginsWith /webhooks/" \
  "id:1057511,phase:2,deny,status:400,\
   msg:'CVE-2026-57511 CRLF injection attempt in webhook payload',\
   chain"
  SecRule REQUEST_BODY "@rx (?:%0[da]|\r|\n)" \
    "t:none,t:lowercase"