Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

SuperPlane lets attackers inject false email headers

CVE-2026-57511 · published 3 months ago
Summary

Versions of SuperPlane before 0.30.0 let anyone send specially crafted webhook events that add extra lines to outgoing emails. This can be used to add hidden recipients, fake the sender address, or corrupt the email content, making phishing or data leakage easier. Upgrade to SuperPlane 0.30.0 or later, or apply the vendor's patch, to stop the injection.

What to do
  • Update superplanehq superplane to version 0.30.0 or later.
Affected software
VendorProductAffected versions
superplanehq superplane < 0.30.0
Original advisory text
SuperPlane < 0.30.0 SMTP Header Injection via Webhook Event Title
SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows unauthenticated attackers to inject arbitrary SMTP headers by including CRLF sequences in the event payload title field delivered via webhook. Attackers can manipulate the unsanitized title field passed to the SMTP DATA command to add Bcc recipients for content exfiltration, forge the From address to bypass SPF and DKIM checks, or inject Content-Type and MIME boundary headers to corrupt message bodies for phishing.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')
Timeline
Published28 Jul 2026
Updated4 Nov 2026
First seen28 Jul 2026
Sources
CVE-2026-57511 · NVD
CVE-2026-57511 · MITRE
CVE-2026-57511 · OSV
Track software like this
Free during beta