Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-59157 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP requests. Prior to 1.22.0, webhookd deployments without htpasswd authentication forwarded all incoming HTTP headers through HTTPParamsToShellVars in pkg/api/index.go into the hook script environment without an allowlist. When an upstream reverse proxy did not strip a client-supplied X-WebAuthn-User header and a hook script trusted that variable for identity or privilege, a remote unauthenticated attacker could spoof another user, bypass script security controls, and access or modify resources available to the impersonated identity. This issue is fixed in version 1.22.0.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:7.4 HIGHVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CNA: [email protected]CVSS-B:6.5 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/ncarlier/webhookd/commit/5ac66677bf7224191f1dfc51a875b09187d10beb	[email protected]	Source CodeVendor
https://github.com/ncarlier/webhookd/pull/121	[email protected]	Issue TrackingVendor
https://github.com/ncarlier/webhookd/releases/tag/v1.22.0	[email protected]	Release NotesVendor
https://github.com/ncarlier/webhookd/security/advisories/GHSA-v25g-mvwr-f5fp	[email protected]	AdvisoryRemedyVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-290	Authentication Bypass by Spoofing	[email protected]
CWE-807	Reliance on Untrusted Inputs in a Security Decision	[email protected]

Affected Products

Product	Versions
webhookd	< 1.22
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: 1.22.0moderate effort Workaround:low effort Enable Basic Auth (`htpasswd`) middleware to prevent all incoming HTTP headers from being forwarded to the webhook script execution environment. Mitigation:low effort Configure the `WHD_ALLOWED_UPSTREAM_HEADERS` setting to enforce a strict allowlist of HTTP headers that can be converted into shell variables. The default allowed headers are now restricted to standard operational headers: `Accept, Content-Type, Content-Length, User-Agent, X-Forwarded-For`. Administrators relying on upstream authentication proxies must explicitly add their authentication headers (e.g., `WHD_ALLOWED_UPSTREAM_HEADERS="Accept, Content-Type, Content-Length, User-Agent, X-Forwarded-For, x-webauthn-user"`) to ensure they are passed to the scripts securely.

Product

Versions

webhookd

< 1.22

CPE

No CPEs found in CPE dictionary for this product.

Remediation

Upgrade: 1.22.0moderate effort
Workaround:low effort
Enable Basic Auth (`htpasswd`) middleware to prevent all incoming HTTP headers from being forwarded to the webhook script execution environment.
Mitigation:low effort
Configure the `WHD_ALLOWED_UPSTREAM_HEADERS` setting to enforce a strict allowlist of HTTP headers that can be converted into shell variables. The default allowed headers are now restricted to standard operational headers: `Accept, Content-Type, Content-Length, User-Agent, X-Forwarded-For`. Administrators relying on upstream authentication proxies must explicitly add their authentication headers (e.g., `WHD_ALLOWED_UPSTREAM_HEADERS="Accept, Content-Type, Content-Length, User-Agent, X-Forwarded-For, x-webauthn-user"`) to ensure they are passed to the scripts securely.

Change History

2 change records found show changes

Date	Action	Recorded By
Sep 16, 2026	CVE Modified	CISA-ADP
Sep 15, 2026	New CVE Received	[email protected]