Executive brief
Bugsink, an error-tracking and log-aggregation tool, contains a vulnerability in how it validates webhook addresses. An attacker with permission to configure webhooks could bypass security filters to send automated requests to internal or restricted servers. This could lead to unauthorized access to internal network services or data exposure within the corporate environment.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Bugsink versions 2.1.2 and earlier due to a parser differential between Python's 'urllib.parse.urlparse' (used for validation) and the 'requests/urllib3' stack (used for execution). By using malformed URLs containing specific characters like backslashes and '@' symbols, an attacker can bypass outbound-host allowlists. This allows the application to be coerced into sending HTTP POST requests to restricted destinations, such as loopback or private IP addresses. The vulnerability is mitigated by the fact that Bugsink does not follow redirects and the request structure is constrained by the HTTP client's normalization. The issue is fixed in version 2.1.3 by synchronizing the normalization logic and rejecting non-RFC compliant characters.
Affected products
- bugsink bugsink <= 2.1.2
Timeline
- 2026-05-05: disclosed: Initial disclosure by vendor
- 2026-05-08: advisory: GitHub Advisory published
- 2026-05-26: other: NVD publication date