Vulnerability · Published Sep 15, 2026 · Assigned by GitHub_M
CVE-2026-59157webhookd: Unrestricted HTTP Header to Shell Variable Injection
Medium 6.5
In plain English
A medium-severity authentication bypass by spoofing in webhookd from ncarlier. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP requests. Prior to 1.22.0, webhookd deployments without htpasswd authentication forwarded all incoming HTTP headers through HTTPParamsToShellVars in pkg/api/index.go into the hook script environment without an allowlist. When an upstream reverse proxy did not strip a client-supplied X-WebAuthn-User header and a hook script trusted that variable for identity or privilege, a remote unauthenticated attacker could spoof another user, bypass script security controls, and access or modify resources available to the impersonated identity. This issue is fixed in version 1.22.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/ncarlier/webhookd | 1.22.0 | GO-2026-6451 |
| Go | github.com/ncarlier/webhookd | 1.22.0 | GHSA-v25g-mvwr-f5fp |
Affected products (as reported)
Weakness: CWE-290, CWE-807 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
References
- https://github.com/ncarlier/webhookd/security/advisories/GHSA-v25g-mvwr-f5fp x_refsource_CONFIRM
- https://github.com/ncarlier/webhookd/pull/121 x_refsource_MISC
- https://github.com/ncarlier/webhookd/commit/5ac66677bf7224191f1dfc51a875b09187d10beb x_refsource_MISC
- https://github.com/ncarlier/webhookd/releases/tag/v1.22.0 x_refsource_MISC