CVE-2026-57511

SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows unauthenticated attackers to inject arbitrary SMTP headers by including CRLF sequences in the event payload title field delivered via webhook. Attackers can manipulate the unsanitized title field passed to the SMTP DATA command to add Bcc recipients for content exfiltration, forge the From address to bypass SPF and DKIM checks, or inject Content-Type and MIME boundary headers to corrupt message bodies for phishing.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/superplanehq/superplane/commit/428c559dd2fa0aef3ba825a434a1b05c9abc7df7
https://github.com/superplanehq/superplane/pull/6354
https://github.com/superplanehq/superplane/releases/tag/v0.30.0
https://www.vulncheck.com/advisories/superplane-smtp-header-injection-via-webhook-event-title

Configurations

No configuration.

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) SuperPlane anterior a la versión 0.30.0 contiene una vulnerabilidad de inyección de encabezados SMTP que permite a atacantes no autenticados inyectar encabezados SMTP arbitrarios al incluir secuencias CRLF en el campo de título de la carga útil del evento entregado a través de un webhook. Los atacantes pueden manipular el campo de título no saneado pasado al comando SMTP DATA para añadir destinatarios CCO para la exfiltración de contenido, falsificar la dirección De para eludir las comprobaciones SPF y DKIM, o inyectar encabezados Content-Type y de límite MIME para corromper los cuerpos de los mensajes para phishing.

Information

Published : 2026-07-28 20:17

Updated : 2026-10-23 23:10

NVD link : CVE-2026-57511

Mitre link : CVE-2026-57511

CVE.ORG link : CVE-2026-57511

JSON object : View

Products Affected

No product.

CWE

CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')

{"id": "CVE-2026-57511", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57511", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-29T13:23:08.944613Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/superplanehq/superplane", "vendor": "superplanehq", "product": "superplane", "versions": [{"status": "affected", "version": "0", "lessThan": "0.30.0", "versionType": "semver"}], "packageURL": "pkg:github/superplanehq/superplane", "defaultStatus": "affected"}]}], "published": "2026-07-28T20:17:27.197", "references": [{"url": "https://github.com/superplanehq/superplane/commit/428c559dd2fa0aef3ba825a434a1b05c9abc7df7", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/superplanehq/superplane/pull/6354", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/superplanehq/superplane/releases/tag/v0.30.0", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/superplane-smtp-header-injection-via-webhook-event-title", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-93"}]}], "descriptions": [{"lang": "en", "value": "SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows unauthenticated attackers to inject arbitrary SMTP headers by including CRLF sequences in the event payload title field delivered via webhook. Attackers can manipulate the unsanitized title field passed to the SMTP DATA command to add Bcc recipients for content exfiltration, forge the From address to bypass SPF and DKIM checks, or inject Content-Type and MIME boundary headers to corrupt message bodies for phishing."}, {"lang": "es", "value": "SuperPlane anterior a la versi\u00f3n 0.30.0 contiene una vulnerabilidad de inyecci\u00f3n de encabezados SMTP que permite a atacantes no autenticados inyectar encabezados SMTP arbitrarios al incluir secuencias CRLF en el campo de t\u00edtulo de la carga \u00fatil del evento entregado a trav\u00e9s de un webhook. Los atacantes pueden manipular el campo de t\u00edtulo no saneado pasado al comando SMTP DATA para a\u00f1adir destinatarios CCO para la exfiltraci\u00f3n de contenido, falsificar la direcci\u00f3n De para eludir las comprobaciones SPF y DKIM, o inyectar encabezados Content-Type y de l\u00edmite MIME para corromper los cuerpos de los mensajes para phishing."}], "lastModified": "2026-10-23T23:10:00.157", "sourceIdentifier": "disclosure@vulncheck.com"}