CVE-2026-44502

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44502", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-06T18:28:20.886Z", "datePublished": "2026-05-26T16:13:32.350Z", "dateUpdated": "2026-05-27T17:21:38.121Z"}, "containers": {"cna": {"title": "Bugsink: SSRF bypass in `validate_webhook_url`", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/bugsink/bugsink/security/advisories/GHSA-fp53-qcf8-2xx2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/bugsink/bugsink/security/advisories/GHSA-fp53-qcf8-2xx2"}, {"name": "https://github.com/bugsink/bugsink/commit/940d2df635e06803ef658666d734306942db5cc7", "tags": ["x_refsource_MISC"], "url": "https://github.com/bugsink/bugsink/commit/940d2df635e06803ef658666d734306942db5cc7"}, {"name": "https://github.com/bugsink/bugsink/releases/tag/2.1.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/bugsink/bugsink/releases/tag/2.1.3"}], "affected": [{"vendor": "bugsink", "product": "bugsink", "versions": [{"version": "< 2.1.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-26T16:13:32.350Z"}, "descriptions": [{"lang": "en", "value": "Bugsink is a self-hosted error tracking tool. Prior to 2.1.3, Bugsink\u2019s webhook URL validation could be (partially) bypassed because of a mismatch in URL parsing. The original validation logic parsed webhook URLs with Python\u2019s urllib.parse.urlparse, then sent the request with requests.post. For malformed inputs involving backslashes and @, those components can disagree about where the authority ends and which hostname is the real target. A URL may therefore appear to target an allowlisted public hostname during validation, while the HTTP client actually connects to a different host. This vulnerability is fixed in 2.1.3."}], "source": {"advisory": "GHSA-fp53-qcf8-2xx2", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-27T17:21:30.414936Z", "id": "CVE-2026-44502", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T17:21:38.121Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Bugsink: SSRF bypass in `validate_webhook_url`", "source": {"advisory": "GHSA-fp53-qcf8-2xx2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "bugsink", "product": "bugsink", "versions": [{"status": "affected", "version": "< 2.1.3"}]}], "references": [{"url": "https://github.com/bugsink/bugsink/security/advisories/GHSA-fp53-qcf8-2xx2", "name": "https://github.com/bugsink/bugsink/security/advisories/GHSA-fp53-qcf8-2xx2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/bugsink/bugsink/commit/940d2df635e06803ef658666d734306942db5cc7", "name": "https://github.com/bugsink/bugsink/commit/940d2df635e06803ef658666d734306942db5cc7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/bugsink/bugsink/releases/tag/2.1.3", "name": "https://github.com/bugsink/bugsink/releases/tag/2.1.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Bugsink is a self-hosted error tracking tool. Prior to 2.1.3, Bugsink\u2019s webhook URL validation could be (partially) bypassed because of a mismatch in URL parsing. The original validation logic parsed webhook URLs with Python\u2019s urllib.parse.urlparse, then sent the request with requests.post. For malformed inputs involving backslashes and @, those components can disagree about where the authority ends and which hostname is the real target. A URL may therefore appear to target an allowlisted public hostname during validation, while the HTTP client actually connects to a different host. This vulnerability is fixed in 2.1.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-26T16:13:32.350Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44502", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-27T17:21:30.414936Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-05-27T17:21:34.554Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-44502", "state": "PUBLISHED", "dateUpdated": "2026-05-26T16:13:32.350Z", "dateReserved": "2026-05-06T18:28:20.886Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-26T16:13:32.350Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "bugsink", "vendor": "bugsink", "versions": [{"status": "affected", "version": "< 2.1.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Bugsink is a self-hosted error tracking tool. Prior to 2.1.3, Bugsink\u2019s webhook URL validation could be (partially) bypassed because of a mismatch in URL parsing. The original validation logic parsed webhook URLs with Python\u2019s urllib.parse.urlparse, then sent the request with requests.post. For malformed inputs involving backslashes and @, those components can disagree about where the authority ends and which hostname is the real target. A URL may therefore appear to target an allowlisted public hostname during validation, while the HTTP client actually connects to a different host. This vulnerability is fixed in 2.1.3."}, {"lang": "es", "value": "Bugsink es una herramienta de seguimiento de errores autoalojada. Antes de la versi\u00f3n 2.1.3, la validaci\u00f3n de URL de webhook de Bugsink podr\u00eda ser (parcialmente) eludida debido a una discrepancia en el an\u00e1lisis de URL. La l\u00f3gica de validaci\u00f3n original analizaba las URL de webhook con urllib.parse.urlparse de Python, luego enviaba la solicitud con requests.post. Para entradas malformadas que involucran barras invertidas y @, esos componentes pueden discrepar sobre d\u00f3nde termina la autoridad y qu\u00e9 nombre de host es el objetivo real. Una URL puede, por lo tanto, parecer apuntar a un nombre de host p\u00fablico en lista blanca durante la validaci\u00f3n, mientras que el cliente HTTP en realidad se conecta a un host diferente. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.1.3."}], "id": "CVE-2026-44502", "lastModified": "2026-07-24T11:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44502", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-27T17:21:30.414936Z", "version": "2.0.3"}}]}, "published": "2026-05-26T17:16:46.387", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/bugsink/bugsink/commit/940d2df635e06803ef658666d734306942db5cc7"}, {"source": "security-advisories@github.com", "url": "https://github.com/bugsink/bugsink/releases/tag/2.1.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/bugsink/bugsink/security/advisories/GHSA-fp53-qcf8-2xx2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.1.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "bugsink", "source": "cna", "vendor": "bugsink"}, "product": "bugsink", "vendor": "bugsink"}], "created": "2026-05-26T18:45:12.775208+00:00", "updated": "2026-05-26T19:45:06.481657+00:00", "vendors": ["bugsink", "bugsink$PRODUCT$bugsink"]}