CVE-2026-59157: Ncarlier Webhookd

Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days.

webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP requests. Prior to 1.22.0, webhookd deployments without htpasswd authentication forwarded all incoming HTTP headers through HTTPParamsToShellVars in pkg/api/index.go into the hook script environment without an allowlist. When an upstream reverse proxy did not strip a client-supplied X-WebAuthn-User header and a hook script trusted that variable for identity or privilege, a remote unauthenticated attacker could spoof another user, bypass script security controls, and access or modify resources available to the impersonated identity. This issue is fixed in version 1.22.0.

Affected products

• Ncarlier Webhookd: before 1.22 (fixed in 1.22)

Published 2026-09-15. Last modified 2026-09-30.