{"id":"EUVD-2026-78685","enisaUuid":"b13e3adc-5297-379f-8ab6-db87248a0cae","description":"webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP requests. Prior to 1.22.0, webhookd deployments without htpasswd authentication forwarded all incoming HTTP headers through HTTPParamsToShellVars in pkg/api/index.go into the hook script environment without an allowlist. When an upstream reverse proxy did not strip a client-supplied X-WebAuthn-User header and a hook script trusted that variable for identity or privilege, a remote unauthenticated attacker could spoof another user, bypass script security controls, and access or modify resources available to the impersonated identity. This issue is fixed in version 1.22.0.","datePublished":"Sep 15, 2026, 3:46:35 PM","dateUpdated":"Sep 16, 2026, 3:38:42 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/ncarlier/webhookd/security/advisories/GHSA-v25g-mvwr-f5fp\nhttps://github.com/ncarlier/webhookd/pull/121\nhttps://github.com/ncarlier/webhookd/commit/5ac66677bf7224191f1dfc51a875b09187d10beb\nhttps://github.com/ncarlier/webhookd/releases/tag/v1.22.0\n","aliases":"CVE-2026-59157\nGHSA-v25g-mvwr-f5fp\n","assigner":"GitHub_M","epss":0.6,"enisaIdProduct":[{"id":"a13d3b4b-f1e4-366c-962b-a6a349cced2d","product":{"name":"webhookd","vendor":{"name":"ncarlier"}},"product_version":"\u003c 1.22"}],"enisaIdVendor":[{"id":"a43783ec-967d-3238-8230-8e8b56fb1dd6","vendor":{"name":"ncarlier"}}],"enisaIdVulnerability":[{"id":"2697436b-e1a3-3655-847b-bfea3963f3a6","vulnerability":{"id":"GHSA-v25g-mvwr-f5fp","description":"webhookd: Unrestricted HTTP Header to Shell Variable Injection","datePublished":"Sep 9, 2026, 11:47:03 PM","dateUpdated":"Sep 9, 2026, 11:47:03 PM","baseScore":0.0,"references":"https://github.com/ncarlier/webhookd/security/advisories/GHSA-v25g-mvwr-f5fp\nhttps://github.com/ncarlier/webhookd\nhttps://github.com/ncarlier/webhookd/releases/tag/v1.22.0\n","enisa_id":"EUVD-2026-78685\n","aliases":"CVE-2026-59157\nGHSA-v25g-mvwr-f5fp\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:53:05 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"74e4e476-332d-3753-af39-67c3d658eb25","vulnerability":{"id":"CVE-2026-59157","description":"webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP requests. Prior to 1.22.0, webhookd deployments without htpasswd authentication forwarded all incoming HTTP headers through HTTPParamsToShellVars in pkg/api/index.go into the hook script environment without an allowlist. When an upstream reverse proxy did not strip a client-supplied X-WebAuthn-User header and a hook script trusted that variable for identity or privilege, a remote unauthenticated attacker could spoof another user, bypass script security controls, and access or modify resources available to the impersonated identity. This issue is fixed in version 1.22.0.","datePublished":"Sep 15, 2026, 3:46:35 PM","dateUpdated":"Sep 16, 2026, 3:38:42 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/ncarlier/webhookd/security/advisories/GHSA-v25g-mvwr-f5fp\nhttps://github.com/ncarlier/webhookd/pull/121\nhttps://github.com/ncarlier/webhookd/commit/5ac66677bf7224191f1dfc51a875b09187d10beb\nhttps://github.com/ncarlier/webhookd/releases/tag/v1.22.0\n","enisa_id":"EUVD-2026-78685\n","assigner":"GitHub_M","epss":0.6,"dataProcessed":"Nov 11, 2026, 7:23:09 AM","vulnerabilityProduct":[{"id":"cc33c88e-0ba7-38a0-8bc2-4548e6ee48a6","product":{"name":"webhookd","vendor":{"name":"ncarlier"}},"product_version":"\u003c 1.22"}],"vulnerabilityVendor":[{"id":"4a24d2a9-3dc8-3df7-a219-bb8aef558af3","vendor":{"name":"ncarlier"}}]}}],"enisaIdAdvisory":[]}