CVE-2026-32096 - Vulnerability Analysis

Overview

Plunk < 0.7.0 contains a server-side request forgery caused by improper validation in the SNS webhook handler, letting unauthenticated attackers make arbitrary outbound HTTP GET requests, exploit requires no authentication.

Severity & Score

Impact

Unauthenticated attackers can make arbitrary outbound HTTP requests from the server, potentially accessing internal resources or causing SSRF attacks.

Mitigation

Update to version 0.7.0 or later.

References

• https://github.com/useplunk/plunk/commit/b8f1ad9ab53c78f8ef063fdc125f397c8bfc7652
• https://github.com/useplunk/plunk/security/advisories/GHSA-xpqg-p8mp-7g44

Social Media Activity(1 post)

Offensive Sequence

@offseq

Mar 12, 2026

🚨 CVE-2026-32096: CRITICAL SSRF in Plunk < 0.7.0 lets unauthenticated attackers trigger arbitrary outbound HTTP requests via SNS webhook. Upgrade to 0.7.0+ ASAP. Monitor egress and review webhook configs. https://radar.offseq.com/threat/cve-2026-32096-cwe-918-server-side-request-forgery-4e688d7e #OffSeq #SSRF #CloudSecurity

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner