CVE-2026-57511 in SuperPlane
Summary
by MITRE • 07/28/2026
SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows unauthenticated attackers to inject arbitrary SMTP headers by including CRLF sequences in the event payload title field delivered via webhook. Attackers can manipulate the unsanitized title field passed to the SMTP DATA command to add Bcc recipients for content exfiltration, forge the From address to bypass SPF and DKIM checks, or inject Content-Type and MIME boundary headers to corrupt message bodies for phishing.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
The vulnerability in SuperPlane versions prior to 0300 represents a critical security flaw that exploits improper input validation within the webhook processing pipeline. This issue stems from insufficient sanitization of user-supplied data when constructing SMTP headers, creating an avenue for malicious actors to inject arbitrary header content through carefully crafted payloads. The vulnerability specifically targets the event payload title field which is directly incorporated into the SMTP DATA command without adequate filtering or encoding mechanisms.
The technical exploitation occurs when an attacker sends a webhook containing CRLF (Carriage Return Line Feed) sequences within the title field of an event payload. These sequences, when processed by the application's SMTP header construction logic, allow attackers to inject additional headers that would normally be excluded from user input. This injection mechanism operates at the protocol level where SMTP commands are constructed, enabling manipulation of the email transmission process itself rather than merely affecting display properties.
From an operational impact perspective, this vulnerability enables several sophisticated attack vectors that can compromise email security and integrity. The ability to inject Bcc recipients allows for covert content exfiltration without detection by normal email monitoring systems, as these recipients receive messages without the primary recipient's knowledge. Attackers can also forge the From address field to bypass standard email authentication mechanisms including SPF and DKIM checks, making malicious communications appear legitimate to recipients and email servers. Additionally, the injection of Content-Type and MIME boundary headers allows for message body corruption that can be used to deliver phishing content or malware through seemingly legitimate emails.
The vulnerability maps directly to CWE-113, which describes improper neutralization of CRLF characters in HTTP headers, and aligns with ATT&CK technique T1192, specifically targeting the exploitation of email protocols for data exfiltration and social engineering. This weakness demonstrates poor input validation practices that are common in applications processing user-supplied content for protocol-level operations. The vulnerability represents a classic case of insufficient sanitization of user inputs before they are integrated into system commands or protocols.
The recommended mitigations include implementing comprehensive input validation and sanitization for all user-supplied data that will be used in SMTP header construction. This involves removing or encoding CRLF sequences from title fields and other potentially vulnerable input parameters before processing. Additionally, the application should implement strict header validation that ensures only properly formatted headers are accepted. The developers should also consider implementing a whitelist-based approach for header construction where only predefined valid header names and values are permitted. Regular security auditing of all protocol-level data handling functions should be conducted to identify similar vulnerabilities in other components of the system architecture.