CVE-2026-44502 Bugsink: SSRF bypass in `validate_webhook_url`
Attackers can bypass webhook URL validation to access internal resources via SSRF in Bugsink error tracking tool.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44502?
CVE-2026-44502 is a medium-severity server-side request forgery vulnerability in bugsink, published on 26 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Bugsink is a self-hosted error tracking tool. Prior to 2.1.3, Bugsink’s webhook URL validation could be (partially) bypassed because of a mismatch in URL parsing. The original validation logic parsed webhook URLs with Python’s urllib.parse.urlparse, then sent the request with requests.post. For malformed inputs involving backslashes and @, those components can disagree about where the authority ends and which hostname is the real target. A URL may therefore appear to target an allowlisted public hostname during validation, while the HTTP client actually connects to a different host. This vulnerability is fixed in 2.1.3.
Weakness: CWE-918
Which versions are affected by CVE-2026-44502?
3 open source packages ship an affected version, including bugsink.
| Package | Affected | Fixed in |
|---|---|---|
bugsink PyPI | All versions | 2.1.3 |
bugsink PyPI | All versions | 2.1.3 |
bugsink PyPI | All versions | 2.1.3 |
How do I fix CVE-2026-44502?
Upgrade bugsink to 2.1.3 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-44502 being exploited?
There is no known exploitation of CVE-2026-44502 in the wild and no public exploit code.
Sources
Also known as GHSA-fp53-qcf8-2xx2, PYSEC-2026-2405.