CVE-2026-59157: ncarlier webhookd Authentication Bypass by Spoofing

Vulnerability summary

CVE-2026-59157 is a medium (CVSS 6.5) Authentication Bypass by Spoofing vulnerability in ncarlier webhookd. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 47.3% of scored vulnerabilities.

Timeline

1. 15-09-2026
   PublishedVulnerability first disclosed.
2. 16-09-2026
   Last modifiedVulnerability information updated.

Description

webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP requests. Prior to 1.22.0, webhookd deployments without htpasswd authentication forwarded all incoming HTTP headers through HTTPParamsToShellVars in pkg/api/index.go into the hook script environment without an allowlist. When an upstream reverse proxy did not strip a client-supplied X-WebAuthn-User header and a hook script trusted that variable for identity or privilege, a remote unauthenticated attacker could spoof another user, bypass script security controls, and access or modify resources available to the impersonated identity. This issue is fixed in version 1.22.0.

• CWE-290Authentication Bypass by SpoofingThis attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
• CWE-807Reliance on Untrusted Inputs in a Security DecisionThe product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.