CVE-2026-44502 Details

A vulnerability in Bugsink's webhook URL validation prior to version 2.1.3 allowed for a partial bypass due to inconsistencies in URL parsing. This issue could enable an attacker to manipulate webhook URLs, causing Bugsink to send HTTP POST requests to unintended hosts, including loopback or private addresses, that should have been blocked by the validation logic. The vulnerability arises from malformed URLs that confuse Python's standard URL parser and the HTTP client, leading to discrepancies about the actual target host. Although this creates a validation bypass, the impact is somewhat limited as Bugsink's webhook requests do not follow redirects and the malformed URL exploitation is constrained by how the HTTP client normalizes the URL.

Users can upgrade to Bugsink version 2.1.3 or later, where this vulnerability has been fixed. In the meantime, it is advisable to restrict who can modify webhook URLs and review existing configurations for any malformed URLs.