CVE-2026-57511 describes an SMTP header injection vulnerability in SuperPlane prior to version 0.30.0. The issue arises because the event payload title field, delivered via webhook, is not properly sanitized for CRLF sequences before being passed to the SMTP DATA command. This allows unauthenticated attackers to inject arbitrary SMTP headers such as Bcc recipients, forged From addresses to bypass SPF and DKIM, or Content-Type and MIME boundary headers that can corrupt email message bodies, facilitating phishing or content exfiltration.

An attacker can exploit this vulnerability to manipulate email headers, enabling unauthorized Bcc recipients to receive sensitive information, forging sender addresses to bypass email authentication mechanisms like SPF and DKIM, and corrupting email content to facilitate phishing attacks. This can lead to data leakage, spoofing, and phishing risks.

No official patch or remediation level is currently provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider mitigating exposure by restricting webhook inputs or sanitizing event payload title fields before processing them in SMTP commands.