PT-2026-39265 · Bugsink+1 · Bugsink

Fushuling + 1 · Published 2026-05-08 · Updated 2026-05-26 · CVE-2026-44502

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bugsink versions prior to 2.1.3

Description A mismatch in URL parsing allows the bypass of webhook URL validation. The system used Python's urllib.parse.urlparse for validation but requests.post to send the request. For malformed inputs containing backslashes and @, these components may disagree on the target hostname. This allows a URL to appear as an allowlisted public hostname during validation while the HTTP client connects to a different host, such as loopback, private, or non-allowlisted destinations. This results in a Server-Side Request Forgery (SSRF), where the server is induced to make an unintended outbound HTTP POST request.

Recommendations Update to version 2.1.3. Restrict permissions for users who can configure or modify webhook URLs. Review existing webhook configurations for malformed or unusual URLs. Implement a tightly controlled outbound network policy at the deployment level.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-44502

GHSA-FP53-QCF8-2XX2

Affected Products

Bugsink

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-44502 · Security Note
• https://osv.dev/vulnerability/GHSA-fp53-qcf8-2xx2 · Vendor Advisory
• https://github.com/bugsink/bugsink/security/advisories/GHSA-fp53-qcf8-2xx2 · Note
• https://github.com/bugsink/bugsink/releases/tag/2.1.3 · Note
• https://github.com/bugsink/bugsink/commit/940d2df635e06803ef658666d734306942db5cc7 · Note
• https://github.com/bugsink/bugsink · Note