Webhook URL Validation Bypass in Bugsink Error Tracking Tool

CVE-2026-44502

What is CVE-2026-44502?

Bugsink, a self-hosted error tracking tool, had a vulnerability where the webhook URL validation could be bypassed due to discrepancies in URL parsing. The issue arose when the original validation logic employed Python’s urllib.parse.urlparse, which did not align with how requests.post processed the URLs. Malformed inputs using backslashes and '@' created mismatches, leading to potential security risks where an allowlisted hostname could be misrepresented. This flaw was addressed in version 2.1.3, emphasizing the need for users to update their installations to ensure security and integrity.

References