MEDIUM 6.5 GitHub
CVE-2026-59157
webhookd: Unrestricted HTTP Header to Shell Variable Injection
## Description
Before 1.22, if the Basic Auth (`htpasswd`) middleware was not configured, all incoming HTTP headers were blindly forwarded to the webhook script execution environment as shell variables. While the Basic Auth middleware correctly strips the authentication header (`X-WebAuthn-User`) from the incoming request before conditionally re-injecting it on successful authentication, disabling Basic Auth left the system vulnerable if deployed behind an unhardened reverse proxy.
## Impact
If
Affected Products
- go/github.com/ncarlier/webhookd < 1.22.0
References
- https://github.com/advisories/GHSA-v25g-mvwr-f5fp
- https://github.com/ncarlier/webhookd/security/advisories/GHSA-v25g-mvwr-f5fp
- https://github.com/ncarlier/webhookd/releases/tag/v1.22.0
- https://github.com/advisories/GHSA-v25g-mvwr-f5fp
This medium severity vulnerability with a CVSS score of 6.5 was published on 2026-09-09 via GitHub. Affected: go/github.com/ncarlier/webhookd < 1.22.0.
vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.