Server-Side Request Forgery in Plunk Email Platform by UsePlunk
CVE-2026-32096
Key Information:
Badges
What is CVE-2026-32096?
Plunk, the open-source email platform leveraging AWS SES, was found susceptible to a Server-Side Request Forgery (SSRF) vulnerability prior to version 0.7.0. This flaw allowed unauthorized attackers to craft specific requests causing the server to issue arbitrary outbound HTTP GET requests to any reachable host. Prompt updates to version 0.7.0 remediate this security risk, safeguarding against potential exploitation.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
plunk < 0.7.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.