« Back to list

CVE-2026-44502

Status: DeferredMedium (4.3)—

Bugsink is a self-hosted error tracking tool. Prior to 2.1.3, Bugsink’s webhook URL validation could be (partially) bypassed because of a mismatch in URL parsing. The original validation logic parsed webhook URLs with Python’s urllib.parse.urlparse, then sent the request with requests.post. For malformed inputs involving backslashes and @, those components can disagree about where the authority ends and which hostname is the real target. A URL may therefore appear to target an allowlisted public hostname during validation, while the HTTP client actually connects to a different host. This vulnerability is fixed in 2.1.3.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Bugsink — BugsinkAI

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-44502",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-44502",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-27T17:21:30.414936Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "bugsink",
          "product": "bugsink",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.1.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-26T17:16:46.387",
  "references": [
    {
      "url": "https://github.com/bugsink/bugsink/commit/940d2df635e06803ef658666d734306942db5cc7",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/bugsink/bugsink/releases/tag/2.1.3",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/bugsink/bugsink/security/advisories/GHSA-fp53-qcf8-2xx2",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Bugsink is a self-hosted error tracking tool. Prior to 2.1.3, Bugsink’s webhook URL validation could be (partially) bypassed because of a mismatch in URL parsing. The original validation logic parsed webhook URLs with Python’s urllib.parse.urlparse, then sent the request with requests.post. For malformed inputs involving backslashes and @, those components can disagree about where the authority ends and which hostname is the real target. A URL may therefore appear to target an allowlisted public hostname during validation, while the HTTP client actually connects to a different host. This vulnerability is fixed in 2.1.3."
    },
    {
      "lang": "es",
      "value": "Bugsink es una herramienta de seguimiento de errores autoalojada. Antes de la versión 2.1.3, la validación de URL de webhook de Bugsink podría ser (parcialmente) eludida debido a una discrepancia en el análisis de URL. La lógica de validación original analizaba las URL de webhook con urllib.parse.urlparse de Python, luego enviaba la solicitud con requests.post. Para entradas malformadas que involucran barras invertidas y @, esos componentes pueden discrepar sobre dónde termina la autoridad y qué nombre de host es el objetivo real. Una URL puede, por lo tanto, parecer apuntar a un nombre de host público en lista blanca durante la validación, mientras que el cliente HTTP en realidad se conecta a un host diferente. Esta vulnerabilidad está corregida en la versión 2.1.3."
    }
  ],
  "lastModified": "2026-07-24T11:10:00.170",
  "sourceIdentifier": "security-advisories@github.com"
}