« Volver al listado

CVE-2026-44502

Estado: AplazadaMedia (4.3)—

Bugsink is a self-hosted error tracking tool. Prior to 2.1.3, Bugsink’s webhook URL validation could be (partially) bypassed because of a mismatch in URL parsing. The original validation logic parsed webhook URLs with Python’s urllib.parse.urlparse, then sent the request with requests.post. For malformed inputs involving backslashes and @, those components can disagree about where the authority ends and which hostname is the real target. A URL may therefore appear to target an allowlisted public hostname during validation, while the HTTP client actually connects to a different host. This vulnerability is fixed in 2.1.3.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Bugsink — BugsinkAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-44502",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-44502",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-27T17:21:30.414936Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "bugsink",
          "product": "bugsink",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.1.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-26T17:16:46.387",
  "references": [
    {
      "url": "https://github.com/bugsink/bugsink/commit/940d2df635e06803ef658666d734306942db5cc7",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/bugsink/bugsink/releases/tag/2.1.3",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/bugsink/bugsink/security/advisories/GHSA-fp53-qcf8-2xx2",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Bugsink is a self-hosted error tracking tool. Prior to 2.1.3, Bugsink’s webhook URL validation could be (partially) bypassed because of a mismatch in URL parsing. The original validation logic parsed webhook URLs with Python’s urllib.parse.urlparse, then sent the request with requests.post. For malformed inputs involving backslashes and @, those components can disagree about where the authority ends and which hostname is the real target. A URL may therefore appear to target an allowlisted public hostname during validation, while the HTTP client actually connects to a different host. This vulnerability is fixed in 2.1.3."
    },
    {
      "lang": "es",
      "value": "Bugsink es una herramienta de seguimiento de errores autoalojada. Antes de la versión 2.1.3, la validación de URL de webhook de Bugsink podría ser (parcialmente) eludida debido a una discrepancia en el análisis de URL. La lógica de validación original analizaba las URL de webhook con urllib.parse.urlparse de Python, luego enviaba la solicitud con requests.post. Para entradas malformadas que involucran barras invertidas y @, esos componentes pueden discrepar sobre dónde termina la autoridad y qué nombre de host es el objetivo real. Una URL puede, por lo tanto, parecer apuntar a un nombre de host público en lista blanca durante la validación, mientras que el cliente HTTP en realidad se conecta a un host diferente. Esta vulnerabilidad está corregida en la versión 2.1.3."
    }
  ],
  "lastModified": "2026-07-24T11:10:00.170",
  "sourceIdentifier": "security-advisories@github.com"
}