Sentry CORS misconfiguration
Impact
The Sentry API incorrectly returns the access-control-allow-credentials: true HTTP header if the Origin request header ends with the system.base-hostname option of Sentry installation. This only affects installations that have system.base-hostname option explicitly set, as it is empty by default.
Impact is limited since recent versions of major browsers have cross-site cookie blocking enabled by default. However, this flaw could allow other multi-step attacks.
Patches
The patch has been released in Sentry 23.6.2.
Workarounds
For Sentry SaaS customers, no action is needed.
For self-hosted Sentry installations that have system.base-hostname explicitly set, it is recommended to upgrade the installation to 23.6.2 or higher. There are no known workarounds.
References
Credits
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | sentry | >= 23.6.0, < 23.6.2 | 23.6.2 |
References
- https://github.com/getsentry/sentry/commit/ee44c6be35e5e464bc40637580f39867898acd8b
- https://github.com/getsentry/sentry/security/advisories/GHSA-4xqm-4p72-87h6
- https://github.com/getsentry/sentry/pull/52276
- https://github.com/getsentry/self-hosted/releases/tag/23.6.2
- https://nvd.nist.gov/vuln/detail/CVE-2023-36829
- https://github.com/getsentry/sentry/commit/19248fb9802c252665b802aeab02fdc65ed47dc9
- https://github.com/getsentry/sentry
- https://github.com/pypa/advisory-database/tree/main/vulns/sentry/PYSEC-2023-115.yaml
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N- Weakness (CWE)
CWE-697, CWE-863, CWE-942- Platform
- Python (PyPI)
- Package
sentry- Disclosed
- 06.07.2023
- Updated
- 11.10.2026 15:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2023-115 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-4xqm-4p72-87h6 - CC BY 4.0
Vulnerability history: sentry
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 15
- First → latest
- 12.2022 05.2026
- Without a fix
- 1
- Exploited in attacks
- 0
Severity breakdown
- Critical 3
- High 7
- Medium 4
- Low 1
Disclosures per year
- 2022: 1
- 2023: 4
- 2024: 6
- 2025: 1
- 2026: 3
-
Sentry CORS misconfiguration this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.