CVE-2026-57511

Medium

Description

SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows unauthenticated attackers to inject arbitrary SMTP headers by including CRLF sequences in the event payload title field delivered via webhook. Attackers can manipulate the unsanitized title field passed to the SMTP DATA command to add Bcc recipients for content exfiltration, forge the From address to bypass SPF and DKIM checks, or inject Content-Type and MIME boundary headers to corrupt message bodies for phishing.

SeverityMedium

CVSS5.4

Exploit probability—

ProductSuperplane

PublishedJul 28, 2026

First seenJul 28, 2026

Weakness typeCWE-93CWE-93

How to fix

Update

superplanehq superplane0.30.0 or later

Patches

github.com/superplanehq/superplane/commit/428c559dd2fa0aef3ba825a434a1b05c9abc7df7

Vendor advisories

github.com/superplanehq/superplane/releases/tag/v0.30.0

Affected products

Product	Affected versions	Fixed in
superplanehq superplane	v < 0.30.0	0.30.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.