CVE-2026-42193: Plunk Email Platform SNS Webhook Forgery

Unauthenticated SNS Webhook Forgery in Plunk

Plunk, an open-source self-hosted email marketing and transactional email platform built on AWS Simple Email Service (SES), is affected by a critical authentication bypass vulnerability tracked as CVE-2026-42193, published to the National Vulnerability Database (NVD) on May 8, 2026 with a CVSS score of 9.1 (Critical).

The vulnerability resides in the /webhooks/sns endpoint, which handles incoming Amazon Simple Notification Service (SNS) event notifications. Prior to version 0.9.0, Plunk accepted SNS notification payloads from completely unauthenticated requests without performing any validation of:

• SNS message signature — Amazon cryptographically signs all SNS messages; Plunk did not verify this signature
• SNS signing certificate — The certificate URL used to verify the signature was not validated
• Topic ARN — The SNS topic ARN in the payload was not checked against expected/allowed topics

This means any attacker who can send an HTTP POST request to a Plunk instance's /webhooks/sns endpoint can forge a valid-looking Amazon SNS notification and trigger internal email platform logic.

Vulnerability Details

How the Vulnerability Works

Background: AWS SNS Webhooks

When Plunk is integrated with AWS SES, Amazon SNS delivers email event notifications (bounces, complaints, deliveries) to Plunk via HTTP POST requests to the /webhooks/sns endpoint. AWS signs all SNS messages with a private key and includes:

1. A Signature field (base64-encoded cryptographic signature)
2. A SigningCertURL field pointing to the signing certificate
3. A TopicArn field identifying the originating SNS topic

A correctly implemented webhook handler must:

1. Download the certificate from SigningCertURL
2. Verify the certificate is hosted on an expected Amazon domain
3. Verify the message signature using the certificate's public key
4. Validate the TopicArn against a known-good value

The Flaw: Zero Validation

Plunk's SNS webhook handler in versions prior to 0.9.0 performed none of these checks. Any HTTP POST to /webhooks/sns with a properly structured JSON payload would be processed as if it were a legitimate Amazon SNS notification.

An attacker can craft a forged SNS payload and send it directly to the endpoint:

{
  "Type": "Notification",
  "TopicArn": "arn:aws:sns:us-east-1:123456789:fake-topic",
  "Message": "{\"notificationType\":\"Bounce\",\"bounce\":{\"bounceType\":\"Permanent\",...}}",
  "Signature": "FAKESIGNATURE",
  "SigningCertURL": "https://attacker.com/fake.pem"
}

Because no signature, certificate, or topic validation is performed, this payload is processed identically to a legitimate AWS notification.

Potential Impact

Successful exploitation of CVE-2026-42193 could allow an attacker to:

The suppression of email addresses via forged bounce notifications is particularly impactful for marketing platforms: a targeted attack could silently prevent emails from reaching entire mailing lists.

Who Is Affected

Plunk is an open-source, self-hosted alternative to commercial email platforms like Mailchimp and SendGrid, designed for developers who want to manage transactional and marketing email through their own AWS SES account. Organizations running Plunk versions prior to 0.9.0 with the SNS webhook endpoint exposed to the internet are vulnerable.

The vulnerability is network-exploitable from any internet-accessible host with no authentication credentials required.

Remediation

Immediate Action Required

Upgrade Plunk to version 0.9.0 immediately. The fix implements proper SNS message signature verification including:

1. Certificate URL validation — ensures SigningCertURL points to an amazonaws.com domain
2. Cryptographic signature verification — validates the SNS message against Amazon's signing certificate
3. Topic ARN validation — checks the incoming topic against expected configured values

If Immediate Upgrade Is Not Possible

1. Restrict network access to the /webhooks/sns endpoint — limit inbound HTTP access to Amazon SNS IP ranges only (published in the AWS IP address ranges JSON, filter for AMAZON service in your region)
2. Monitor the endpoint for unexpected request sources — any non-AWS IP should be treated as suspicious
3. Audit recent SNS webhook logs for anomalous activity that may indicate prior exploitation

Key Takeaways

1. CVE-2026-42193 is a critical authentication bypass — unauthenticated attackers can forge any Amazon SNS notification type
2. The root cause is a missing validation implementation, not a complex logic flaw — SNS signature verification is a well-documented requirement
3. Email suppression attacks are particularly damaging — forged bounce notifications can silently break email delivery for entire mailing lists
4. Self-hosted email platforms carry significant security responsibility — organizations choosing open-source alternatives must maintain timely patching
5. Fix is available in Plunk v0.9.0 — upgrade immediately if running any prior version

Sources

• CVE-2026-42193 — NVD
• Plunk GitHub Repository