CVE-2026-57511
SuperPlane < 0.30.0 SMTP Header Injection via Webhook Event Title
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows unauthenticated attackers to inject arbitrary SMTP headers by including CRLF sequences in the event payload title field delivered via webhook. Attackers can manipulate the unsanitized title field passed to the SMTP DATA command to add Bcc recipients for content exfiltration, forge the From address to bypass SPF and DKIM checks, or inject Content-Type and MIME boundary headers to corrupt message bodies for phishing.
| CWE | CWE-93 |
| Vendor | superplanehq |
| Product | superplane |
| Published | Jul 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for superplanehq superplane
Be the first to know when new medium vulnerabilities affecting superplanehq superplane are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
superplanehq / superplane
0 < 0.30.0
References
github.com: https://github.com/superplanehq/superplane/releases/tag/v0.30.0 github.com: https://github.com/superplanehq/superplane/pull/6354 github.com: https://github.com/superplanehq/superplane/commit/428c559dd2fa0aef3ba825a434a1b05c9abc7df7 vulncheck.com: https://www.vulncheck.com/advisories/superplane-smtp-header-injection-via-webhook-event-title
Credits
Katriel Moses VulnCheck