CVE-2026-32096

8.6 highEPSS 0.3%

High (8.6) in useplunk plunk. EPSS 0.3% chance of exploitation in the next 30 days.

Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.0, a Server-Side Request Forgery (SSRF) vulnerability existed in the SNS webhook handler. An unauthenticated attacker could send a crafted request that caused the server to make an arbitrary outbound HTTP GET request to any host accessible from the server. This vulnerability is fixed in 0.7.0.

Severity

CVSS 3.1

8.6 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 20% of CVEs (scores of 2026-10-31)
CWE: CWE-918
Published: 2026-03-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

useplunk:plunk

References

https://github.com/useplunk/plunk/commit/b8f1ad9ab53c78f8ef063fdc125f397c8bfc7652
https://github.com/useplunk/plunk/security/advisories/GHSA-xpqg-p8mp-7g44

Check your stack JSON