---
id: CVE-2026-59157
title: >-
  webhookd is a minimalist webhook server that triggers shell scripts and
  external processes through HTTP requests
summary: >-
  webhookd is a minimalist webhook server that triggers shell scripts and
  external processes through HTTP requests. Prior to 1.22.0, webhookd
  deployments without htpasswd authentication forwarded all incoming HTTP
  headers through HTTPParam…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-290
  - CWE-807
vendor: ncarlier
product: webhookd
affected:
  - webhookd < 1.22
patched:
  - github.com/ncarlier/webhookd 1.22.0
published: '2026-09-15'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T16:17:13.713'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59157'
references:
  - url: >-
      https://github.com/ncarlier/webhookd/commit/5ac66677bf7224191f1dfc51a875b09187d10beb
    label: security-advisories@github.com
  - url: 'https://github.com/ncarlier/webhookd/pull/121'
    label: security-advisories@github.com
  - url: 'https://github.com/ncarlier/webhookd/releases/tag/v1.22.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/ncarlier/webhookd/security/advisories/GHSA-v25g-mvwr-f5fp
    label: security-advisories@github.com
  - url: 'https://github.com/ncarlier/webhookd'
  - url: 'https://github.com/advisories/GHSA-v25g-mvwr-f5fp'
tags:
  - nvd
  - cve.org
  - osv
  - go
  - ghsa
aliases:
  - GHSA-v25g-mvwr-f5fp
  - GO-2026-6451
ecosystem: go
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-16T15:38:31.622911Z'
ingestedAt: '2026-09-10T00:26:24.579Z'
epss: 0.00596
epssPercentile: 0.46136
---

## Overview

webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP requests. Prior to 1.22.0, webhookd deployments without htpasswd authentication forwarded all incoming HTTP headers through HTTPParamsToShellVars in pkg/api/index.go into the hook script environment without an allowlist. When an upstream reverse proxy did not strip a client-supplied X-WebAuthn-User header and a hook script trusted that variable for identity or privilege, a remote unauthenticated attacker could spoof another user, bypass script security controls, and access or modify resources available to the impersonated identity. This issue is fixed in version 1.22.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-59157)

Affected packages:

- `github.com/ncarlier/webhookd < 1.22.0`

Patched in:

- `github.com/ncarlier/webhookd 1.22.0`

Source: https://osv.dev/vulnerability/GHSA-v25g-mvwr-f5fp