CVE-2026-44502: Bugsink SSRF bypass in webhook URL validation

CVE-2026-44502 · Severity: medium · CVSS 4.3 · Published 2026-05-26

Bugsink, an error-tracking and log-aggregation tool, contains a vulnerability in how it validates webhook addresses. An attacker with permission to configure webhooks could bypass security filters to send automated requests to internal or restricted servers. This could lead to unauthorized access to internal network services or data exposure within the corporate environment.

Technologies: Bugsink, bugsink (PyPI). Vendors: Bugsink, PyPI.

Quick answers

Is CVE-2026-44502 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44502 being exploited in the wild.
How severe is CVE-2026-44502?
Medium severity, with a CVSS score of 4.3, published 26 May 2026.
Which products and versions are affected?
Bugsink < 2.1.3, <= 2.1.2; bugsink (PyPI) ECOSYSTEM:introduced=0,fixed=2.1.3.
Is there a fix for CVE-2026-44502?
Yes. bugsink (PyPI): upgrade to 2.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44502 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44502?
Check whether you run Bugsink or bugsink (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • bugsink (PyPI): upgrade to 2.1.3 or later
    pip install "bugsink>=2.1.3"

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Bugsink versions 2.1.2 and earlier due to a parser differential between Python's 'urllib.parse.urlparse' (used for validation) and the 'requests/urllib3' stack (used for execution). By using malformed URLs containing specific characters like backslashes and '@' symbols, an attacker can bypass outbound-host allowlists. This allows the application to be coerced into sending HTTP POST requests to restricted destinations, such as loopback or private IP addresses. The vulnerability is mitigated by the fact that Bugsink does not follow redirects and the request structure is constrained by the HTTP client's normalization. The issue is fixed in version 2.1.3 by synchronizing the normalization logic and rejecting non-RFC compliant characters.

Affected products

  • bugsink bugsink <= 2.1.2

Identifiers

  • CVE-2026-44502
  • GHSA-fp53-qcf8-2xx2
  • PYSEC-2026-2405

Timeline

  • 2026-05-05: disclosed: Initial disclosure by vendor
  • 2026-05-08: advisory: GitHub Advisory published
  • 2026-05-26: other: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.