CVE-2026-59157 webhookd: Unrestricted HTTP Header to Shell Variable Injection
Attackers can spoof user identity via HTTP headers in unauthenticated webhookd deployments, bypassing security controls to access or modify resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59157?
CVE-2026-59157 is a medium-severity authentication bypass vulnerability in ncarlier webhookd, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP requests. Prior to 1.22.0, webhookd deployments without htpasswd authentication forwarded all incoming HTTP headers through HTTPParamsToShellVars in pkg/api/index.go into the hook script environment without an allowlist. When an upstream reverse proxy did not strip a client-supplied X-WebAuthn-User header and a hook script trusted that variable for identity or privilege, a remote unauthenticated attacker could spoof another user, bypass script security controls, and access or modify resources available to the impersonated identity. This issue is fixed in version 1.22.0.
Which versions are affected by CVE-2026-59157?
3 open source packages ship an affected version, including github.com/ncarlier/webhookd.
| Package | Affected | Fixed in |
|---|---|---|
github.com/ncarlier/webhookd Go | All versions | 1.22.0 |
github.com/ncarlier/webhookd Go | All versions | 1.22.0 |
github.com/ncarlier/webhookd Go | All versions | 1.22.0 |
How do I fix CVE-2026-59157?
Upgrade github.com/ncarlier/webhookd to 1.22.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-59157 being exploited?
There is no known exploitation of CVE-2026-59157 in the wild and no public exploit code.
Sources
Also known as GHSA-v25g-mvwr-f5fp, GO-2026-6451.