A medium-severity vulnerability, identified as CVE-2026-59157 with a CVSS score of 6.5, affects webhookd prior to version 1.22.0. The flaw arises from the lack of configuration for the Basic Auth middleware, which allows unrestricted HTTP headers to be injected into shell variables when deployed behind an unhardened reverse proxy. This enables attackers to bypass security controls and impersonate other users by manually supplying authentication headers, such as X-WebAuthn-User, if a webhook script relies on forwarded headers for privilege elevation or identity verification. To mitigate this issue, the WHD_ALLOWED_UPSTREAM_HEADERS configuration setting has been introduced to enforce a strict allowlist of HTTP headers that can be converted into shell variables, and the default behavior has been changed to adhere to the principle of least privilege by restricting allowed headers to standard operational headers such as Accept, Content-Type, Content-Length, User-Agent, and X-Forwarded-For. Administrators must explicitly add their authentication headers to ensure they are passed to scripts securely.
We recommend you to update webhookd to version 1.22.0.[/subscribe_to_unlock_form]
A medium-severity vulnerability, identified as CVE-2026-59157 with a CVSS score of 6.5, affects webhookd prior to version 1.22.0. The flaw arises from the lack of configuration for the Basic Auth middleware, which allows unrestricted HTTP headers to be injected into shell variables when deployed behind an unhardened reverse proxy. This enables attackers to bypass security controls and impersonate other users by manually supplying authentication headers, such as X-WebAuthn-User, if a webhook script relies on forwarded headers for privilege elevation or identity verification. To mitigate this issue, the WHD_ALLOWED_UPSTREAM_HEADERS configuration setting has been introduced to enforce a strict allowlist of HTTP headers that can be converted into shell variables, and the default behavior has been changed to adhere to the principle of least privilege by restricting allowed headers to standard operational headers such as Accept, Content-Type, Content-Length, User-Agent, and X-Forwarded-For. Administrators must explicitly add their authentication headers to ensure they are passed to scripts securely.
We recommend you to update webhookd to version 1.22.0.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]