# CVE-2026-83803: Sentry unsafe deserialization in relocation import

Source: https://junglewise.ai/threats/cve-2026-83803-sentry-is-an-error-tracking-and-performance-monitoring-tool-from  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-83803 · Severity: info · Published 2026-09-22

Sentry is an error tracking and performance monitoring platform used by developers to diagnose and fix application issues. Versions 23.11.0 through 26.6.x with the relocation feature enabled contain an unsafe deserialization vulnerability that allows an authenticated user to execute arbitrary code on the import worker process by supplying a malicious relocation archive. This could enable attackers to gain full control of the server processing imports.

Technologies: [Sentry](https://junglewise.ai/threats/technologies/sentry-sentry). Vendors: [Sentry](https://junglewise.ai/threats/vendors/sentry).

## Quick answers

**Is CVE-2026-83803 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-83803 being exploited in the wild.

**How severe is CVE-2026-83803?** Informational severity, published 22 September 2026.

**Which products and versions are affected?** Sentry 23.11.0 to 26.6.x.

**Is there a fix for CVE-2026-83803?** A patch was published on 2026-07-14: Fixed in version 26.7.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-83803 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-83803?** Check whether you run Sentry at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a Python unsafe deserialization (pickle or similar) flaw in the relocation archive import functionality. An authenticated user can craft a malicious archive containing specially crafted data in legacy database fields that triggers arbitrary code execution when deserialized by the import worker. The vulnerability requires authentication and intentional upload of a crafted archive, but the relocation feature must be explicitly enabled (disabled by default in self-hosted installations).

## Affected products

- Sentry Sentry 23.11.0 to 26.6.x

## Timeline

- 2026-09-22: disclosed
- 2026-07-14: patched: Fixed in version 26.7.0

## References

- [https://github.com/getsentry/sentry/commit/d7fd44193c282102f9fcd2c73973820f3d10ac3a](https://github.com/getsentry/sentry/commit/d7fd44193c282102f9fcd2c73973820f3d10ac3a)
- [https://github.com/getsentry/sentry/pull/119622](https://github.com/getsentry/sentry/pull/119622)

## Related threats

- [Sentry SAML SSO identity-linking account takeover](https://junglewise.ai/threats/cve-2026-102899-sentry-is-an-application-monitoring-and-error-tracking-platform)