CVE-2026-44502
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Bugsink, a self-hosted error tracking tool, prior to version 2.1.3 has a vulnerability in webhook URL validation. A mismatch in URL parsing between Python and the requests library allows bypassing validation, so a URL may appear to target an allowed public host while the HTTP request actually goes to a different server.
Risk Assessment
An attacker could redirect webhooks to a malicious server, potentially leading to data interception or further attacks on the infrastructure.
Recommendation
Update Bugsink to version 2.1.3 or later, which includes improved webhook URL validation.
Other vulnerabilities in Bugsink
See all- CVE-2026-47728Medium
Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink resolved sourcemaps and debug files by debug ID without scoping that lookup to the project that owned the uploaded metadata. An authenticated user with access to one project could cause event processing in that project to use sourcemap/debug-file metadata uploaded for another project in the same Bugsink instance, if the same debug ID was referenced.
- CVE-2026-47716Low
Bugsink before 2.2.0 has a vulnerability where the issue list authorizes access via the project in the URL but applies bulk actions to submitted issue IDs without verifying they belong to that project. Fixed in 2.2.0.
- CVE-2026-47715Low
Bugsink before 2.2.0 has a vulnerability where issue event pages accept a direct event identifier from the URL without verifying it belongs to the issue. A user with access to one project can view another project's event data. Fixed in 2.2.0.
Original NVD description (English source)
Bugsink is a self-hosted error tracking tool. Prior to 2.1.3, Bugsink’s webhook URL validation could be (partially) bypassed because of a mismatch in URL parsing. The original validation logic parsed webhook URLs with Python’s urllib.parse.urlparse, then sent the request with requests.post. For malformed inputs involving backslashes and @, those components can disagree about where the authority ends and which hostname is the real target. A URL may therefore appear to target an allowlisted public hostname during validation, while the HTTP client actually connects to a different host. This vulnerability is fixed in 2.1.3.