Server-Side Request Forgery in Plunk Email Platform by UsePlunk
CVE-2026-32096
9.3CRITICAL
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-32096?
Plunk, the open-source email platform leveraging AWS SES, was found susceptible to a Server-Side Request Forgery (SSRF) vulnerability prior to version 0.7.0. This flaw allowed unauthorized attackers to craft specific requests causing the server to issue arbitrary outbound HTTP GET requests to any reachable host. Prompt updates to version 0.7.0 remediate this security risk, safeguarding against potential exploitation.
Affected Version(s)
plunk < 0.7.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.