CVE-2026-44502 (GCVE-0-2026-44502)

Vulnerability from cvelistv5 – Published: 2026-05-26 16:13 – Updated: 2026-05-27 17:21
VLAI
Title
Bugsink: SSRF bypass in `validate_webhook_url`
Summary
Bugsink is a self-hosted error tracking tool. Prior to 2.1.3, Bugsink’s webhook URL validation could be (partially) bypassed because of a mismatch in URL parsing. The original validation logic parsed webhook URLs with Python’s urllib.parse.urlparse, then sent the request with requests.post. For malformed inputs involving backslashes and @, those components can disagree about where the authority ends and which hostname is the real target. A URL may therefore appear to target an allowlisted public hostname during validation, while the HTTP client actually connects to a different host. This vulnerability is fixed in 2.1.3.
Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
Impacted products
Vendor Product Version
bugsink bugsink Affected: < 2.1.3
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44502",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-27T17:21:30.414936Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-27T17:21:38.121Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "bugsink",
          "vendor": "bugsink",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.1.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Bugsink is a self-hosted error tracking tool. Prior to 2.1.3, Bugsink\u2019s webhook URL validation could be (partially) bypassed because of a mismatch in URL parsing. The original validation logic parsed webhook URLs with Python\u2019s urllib.parse.urlparse, then sent the request with requests.post. For malformed inputs involving backslashes and @, those components can disagree about where the authority ends and which hostname is the real target. A URL may therefore appear to target an allowlisted public hostname during validation, while the HTTP client actually connects to a different host. This vulnerability is fixed in 2.1.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-26T16:13:32.350Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/bugsink/bugsink/security/advisories/GHSA-fp53-qcf8-2xx2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/bugsink/bugsink/security/advisories/GHSA-fp53-qcf8-2xx2"
        },
        {
          "name": "https://github.com/bugsink/bugsink/commit/940d2df635e06803ef658666d734306942db5cc7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/bugsink/bugsink/commit/940d2df635e06803ef658666d734306942db5cc7"
        },
        {
          "name": "https://github.com/bugsink/bugsink/releases/tag/2.1.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/bugsink/bugsink/releases/tag/2.1.3"
        }
      ],
      "source": {
        "advisory": "GHSA-fp53-qcf8-2xx2",
        "discovery": "UNKNOWN"
      },
      "title": "Bugsink: SSRF bypass in `validate_webhook_url`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44502",
    "datePublished": "2026-05-26T16:13:32.350Z",
    "dateReserved": "2026-05-06T18:28:20.886Z",
    "dateUpdated": "2026-05-27T17:21:38.121Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-44502",
      "date": "2026-07-25",
      "epss": "0.00286",
      "percentile": "0.20862"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-44502\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-05-26T17:16:46.387\",\"lastModified\":\"2026-07-24T11:10:00.170\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Bugsink is a self-hosted error tracking tool. Prior to 2.1.3, Bugsink\u2019s webhook URL validation could be (partially) bypassed because of a mismatch in URL parsing. The original validation logic parsed webhook URLs with Python\u2019s urllib.parse.urlparse, then sent the request with requests.post. For malformed inputs involving backslashes and @, those components can disagree about where the authority ends and which hostname is the real target. A URL may therefore appear to target an allowlisted public hostname during validation, while the HTTP client actually connects to a different host. This vulnerability is fixed in 2.1.3.\"},{\"lang\":\"es\",\"value\":\"Bugsink es una herramienta de seguimiento de errores autoalojada. Antes de la versi\u00f3n 2.1.3, la validaci\u00f3n de URL de webhook de Bugsink podr\u00eda ser (parcialmente) eludida debido a una discrepancia en el an\u00e1lisis de URL. La l\u00f3gica de validaci\u00f3n original analizaba las URL de webhook con urllib.parse.urlparse de Python, luego enviaba la solicitud con requests.post. Para entradas malformadas que involucran barras invertidas y @, esos componentes pueden discrepar sobre d\u00f3nde termina la autoridad y qu\u00e9 nombre de host es el objetivo real. Una URL puede, por lo tanto, parecer apuntar a un nombre de host p\u00fablico en lista blanca durante la validaci\u00f3n, mientras que el cliente HTTP en realidad se conecta a un host diferente. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.1.3.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"bugsink\",\"product\":\"bugsink\",\"versions\":[{\"version\":\"\u003c 2.1.3\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-27T17:21:30.414936Z\",\"id\":\"CVE-2026-44502\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-918\"}]}],\"references\":[{\"url\":\"https://github.com/bugsink/bugsink/commit/940d2df635e06803ef658666d734306942db5cc7\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/bugsink/bugsink/releases/tag/2.1.3\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/bugsink/bugsink/security/advisories/GHSA-fp53-qcf8-2xx2\",\"source\":\"security-advisories@github.com\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-05-27T20:13:46+00:00",
      "cve": "CVE-2026-44502",
      "id": "CVE-2026-44502",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Bugsink: SSRF bypass in `validate_webhook_url`",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44502.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"Bugsink: SSRF bypass in `validate_webhook_url`\", \"source\": {\"advisory\": \"GHSA-fp53-qcf8-2xx2\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"bugsink\", \"product\": \"bugsink\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2.1.3\"}]}], \"references\": [{\"url\": \"https://github.com/bugsink/bugsink/security/advisories/GHSA-fp53-qcf8-2xx2\", \"name\": \"https://github.com/bugsink/bugsink/security/advisories/GHSA-fp53-qcf8-2xx2\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/bugsink/bugsink/commit/940d2df635e06803ef658666d734306942db5cc7\", \"name\": \"https://github.com/bugsink/bugsink/commit/940d2df635e06803ef658666d734306942db5cc7\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/bugsink/bugsink/releases/tag/2.1.3\", \"name\": \"https://github.com/bugsink/bugsink/releases/tag/2.1.3\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Bugsink is a self-hosted error tracking tool. Prior to 2.1.3, Bugsink\\u2019s webhook URL validation could be (partially) bypassed because of a mismatch in URL parsing. The original validation logic parsed webhook URLs with Python\\u2019s urllib.parse.urlparse, then sent the request with requests.post. For malformed inputs involving backslashes and @, those components can disagree about where the authority ends and which hostname is the real target. A URL may therefore appear to target an allowlisted public hostname during validation, while the HTTP client actually connects to a different host. This vulnerability is fixed in 2.1.3.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-918\", \"description\": \"CWE-918: Server-Side Request Forgery (SSRF)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-05-26T16:13:32.350Z\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-44502\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-27T17:21:30.414936Z\"}}}], \"providerMetadata\": {\"shortName\": \"CISA-ADP\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"dateUpdated\": \"2026-05-27T17:21:34.554Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-44502\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-26T16:13:32.350Z\", \"dateReserved\": \"2026-05-06T18:28:20.886Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-05-26T16:13:32.350Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.