Vulnerability in aws (CVE-2026-42193, CVSS 9.1)

Summary

vulnerability in aws (CVE-2026-42193). Data can be tampered with by attackers.

Original description

The description as published by the source.

Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, the /webhooks/sns endpoint accepts Amazon SNS notification payloads from unauthenticated requests without verifying the SNS signature, certificate, or topic ARN, meaning anyone can forge a valid-looking webhook request. This allows an unauthenticated attacker to spoof SNS events to trigger workflow automations, unsubscribe contacts, manipulate email delivery metrics, and potentially exhaust billing credits. This issue has been patched in version 0.9.0.

Source: NIST National Vulnerability Database NVD

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

A vulnerability in Plunk, an open-source email platform, allows attackers to spoof SNS notifications. This can result in the manipulation of automated workflows, unsubscribing contacts, and altering email metrics. Systems running versions below 0.9.0 are affected, and an immediate update is recommended to mitigate the risk.

The vulnerability CVE-2026-42193 in Plunk's /webhooks/sns endpoint arises from not verifying Amazon SNS signatures, certificates, or topic ARNs. This allows unauthenticated spoofing of SNS events, enabling the abuse of automated workflows. Versions affected are below 0.9.0, and the issue is patched in 0.9.0. Applying the update addresses the risk. Detection can involve monitoring logs for anomalous event activity related to spoofed SNS events.

❓ What is the problem

/webhooks/sns endpoint in Plunk fails to verify SNS signature, certificate, or topic ARN.

📍 Affected scope

Plunk versions <0.9.0.

🔥 Severity

Critical. Allows unauthenticated spoofing of SNS events to disrupt platform functionality.

🔧 How to fix

Upgrade Plunk to version 0.9.0.

🛡️ Workaround

素材から特定できず。

🔍 Detection

Check logs for unexpected SNS event patterns or anomalies.

Related past incidents Similar incidents extracted from past CVEs

CVE-2023-0037

SNS signature verification bypass leading to forgery in another AWS service.

If this happens at your company Expected impact per business scenario

📌 企業のメールマーケティングシステム

偽のSNS通知によりキャンペーンの停止や分析データの改ざん

📌 中小企業の情報システム

誤った通知をトリガーし、自動化された処理の誤作動

📌 サブスクリプション型Webサービス

顧客を誤って解除し、カスタマーエクスペリエンスが低下

Recommended action

直ちにプラットフォームをバージョン0.9.0にアップデートし、潜在的な不正なSNS通知を検知するためのログ監視を強化する。

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
Audit SBOM/dependencies for affected components.
```
依存マニフェストで影響コンポーネントを特定する。
2
Match against affected range verify
```
Confirm if version satisfies `< 0.8.0`
```
Step 1 で見つかったバージョンが影響範囲 < 0.8.0 に該当するか照合。本番で稼働中ならインシデント扱い。
7
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。

Vulnerability in aws (CVE-2026-42193)