CVE-2026-59157
Received Received - Intake

Remote Code Execution in webhookd via Unauthorized HTTP Header Injection

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP requests. Prior to 1.22.0, webhookd deployments without htpasswd authentication forwarded all incoming HTTP headers through HTTPParamsToShellVars in pkg/api/index.go into the hook script environment without an allowlist. When an upstream reverse proxy did not strip a client-supplied X-WebAuthn-User header and a hook script trusted that variable for identity or privilege, a remote unauthenticated attacker could spoof another user, bypass script security controls, and access or modify resources available to the impersonated identity. This issue is fixed in version 1.22.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-59157
EUVD
EUVD-2026-78685

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ncarlier webhookd to 1.22.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-807 The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects webhookd, a minimalist webhook server that runs shell scripts via HTTP requests. Before version 1.22.0, deployments without htpasswd authentication forwarded all HTTP headers into the script environment without filtering. An attacker could send a crafted X-WebAuthn-User header through an upstream proxy, which would then be passed to the script. If the script trusted this header for identity or permissions, the attacker could impersonate another user and bypass security controls.

Detection Guidance

Check if your webhookd version is below 1.22.0 by running: webhookd --version. Inspect HTTP headers forwarded to scripts, especially X-WebAuthn-User. Review hook scripts for trust in HTTP headers from environment variables.

Impact Analysis

If you run webhookd without authentication and use scripts that trust HTTP headers for user identity or permissions, an attacker could impersonate another user and gain unauthorized access to resources or perform actions as that user. This could lead to data leaks, unauthorized modifications, or privilege escalation depending on the script's functionality.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access to sensitive data or systems, which is a direct violation of GDPR's data protection principles and HIPAA's access control mandates. Organizations using affected versions without proper authentication may face regulatory penalties due to insufficient safeguards against impersonation attacks.

Mitigation Strategies

Upgrade webhookd to version 1.22.0 or later. Enable htpasswd authentication if not already configured. Configure reverse proxies to strip sensitive headers like X-WebAuthn-User before forwarding requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59157. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart