CVE-2026-59157: webhookd Authentication Bypass Vulnerability

CVE-2026-59157 Overview

CVE-2026-59157 is an authentication bypass vulnerability in webhookd, a minimalist webhook server that triggers shell scripts through HTTP requests. Versions prior to 1.22.0 forward all incoming HTTP headers into hook script environments without an allowlist. When an upstream reverse proxy fails to strip client-supplied identity headers such as X-WebAuthn-User, a remote unauthenticated attacker can spoof another user. The flaw affects deployments that omit htpasswd authentication and rely on hook scripts trusting these variables for identity or privilege decisions. The maintainer fixed the issue in version 1.22.0 by introducing an optional upstream header allowlist.

Critical Impact
Remote unauthenticated attackers can impersonate arbitrary users, bypass hook script security controls, and access or modify resources belonging to the spoofed identity.

Affected Products

webhookd versions prior to 1.22.0
Deployments without htpasswd authentication
Deployments behind reverse proxies that do not strip client-supplied identity headers

Discovery Timeline

2026-09-15 - CVE-2026-59157 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-59157

Vulnerability Analysis

The vulnerability is classified as Authentication Bypass by Spoofing [CWE-290]. webhookd exposes an HTTP endpoint that dispatches shell scripts as hooks. Every incoming HTTP header is converted into a shell environment variable via HTTPParamsToShellVars inside pkg/api/index.go. No allowlist filters which headers reach the hook script.

When a hook script consults an identity variable such as x_webauthn_user for authorization, it inherits whatever value the client supplied. An attacker sending a crafted X-WebAuthn-User header can therefore assume any identity the script recognizes, without possessing valid credentials.

Root Cause

The root cause is missing input validation on upstream HTTP headers combined with implicit trust in reverse-proxy-supplied identity claims. webhookd assumed that proxies would strip client-supplied variants of authentication headers before forwarding them, but this contract was neither enforced nor documented as a hard requirement.

Attack Vector

Exploitation requires network access to the webhookd endpoint and a hook script that trusts an identity header. The attacker submits an HTTP request with a spoofed identity header, for example X-WebAuthn-User: admin. The hook script executes under the impersonated identity and grants access to resources or actions restricted to that user.

// Security patch in pkg/api/index.go introducing header allowlist

	"github.com/ncarlier/webhookd/pkg/config"
	"github.com/ncarlier/webhookd/pkg/helper"
+	"github.com/ncarlier/webhookd/pkg/helper/header"
	"github.com/ncarlier/webhookd/pkg/hook"
	"github.com/ncarlier/webhookd/pkg/worker"
)

var (
-	defaultTimeout int
-	defaultExt     string
-	defaultMode    string
-	scriptDir      string
-	outputDir      string
+	defaultTimeout         int
+	defaultExt             string
+	defaultMode            string
+	scriptDir              string
+	outputDir              string
+	allowedUpstreamHeaders []string
)
// Source: https://github.com/ncarlier/webhookd/commit/5ac66677bf7224191f1dfc51a875b09187d10beb

Detection Methods for CVE-2026-59157

Indicators of Compromise

HTTP requests to webhookd endpoints containing X-WebAuthn-User or similar identity headers originating from untrusted network segments.
Hook execution logs showing identity values that do not correlate with authenticated proxy sessions.
Unexpected privilege actions performed by hook scripts under identities that never authenticated upstream.

Detection Strategies

Inspect reverse proxy access logs for client-supplied identity headers that should be rejected or overwritten before reaching webhookd.
Correlate webhookd script invocations with upstream authentication events; flag hooks executed without a matching auth record.
Audit installed webhookd versions across your environment and identify hosts running versions below 1.22.0.

Monitoring Recommendations

Enable verbose logging on webhookd to capture the header set forwarded to each hook script.
Alert on outbound actions performed by hook scripts on behalf of privileged identities.
Monitor for configuration drift on reverse proxies to ensure header sanitization rules remain in place.

How to Mitigate CVE-2026-59157

Immediate Actions Required

Upgrade webhookd to version 1.22.0 or later on all deployments.
Configure WHD_ALLOWED_UPSTREAM_HEADERS with an explicit allowlist of headers required by hook scripts.
Enable htpasswd authentication where feasible to add a second control layer.
Review all hook scripts and remove trust in headers that can be supplied by unauthenticated clients.

Patch Information

The maintainer released a fix in webhookd v1.22.0. The change introduces the WHD_ALLOWED_UPSTREAM_HEADERS environment variable, allowing operators to restrict which upstream HTTP headers propagate into the hook script environment. See the GitHub Security Advisory GHSA-v25g-mvwr-f5fp and Pull Request #121 for full details.

Workarounds

Configure the upstream reverse proxy to strip client-supplied identity headers such as X-WebAuthn-User before forwarding to webhookd.
Rewrite hook scripts to derive identity from a proxy-injected header that clients cannot override.
Restrict network access to webhookd so only the trusted reverse proxy can reach it.

bash

# Configuration example from etc/default/webhookd.env

# Allowed upstream HTTP headers, default is "*"
# Comma separated list of HTTP headers to pass to the hook script.
# Example: `x-webauth-user,content-type,user-agent`
WHD_ALLOWED_UPSTREAM_HEADERS="content-type,user-agent"
# Source: https://github.com/ncarlier/webhookd/commit/5ac66677bf7224191f1dfc51a875b09187d10beb