Executive brief
webhookd is a service that executes scripts triggered by incoming webhooks. Before version 1.22, when Basic Authentication was disabled, the application passed all incoming HTTP headers directly to the webhook script environment as shell variables without validation. An attacker could exploit this by injecting crafted HTTP headers (such as authentication headers) through an upstream reverse proxy to impersonate users or escalate privileges within webhook scripts that rely on these headers for security decisions.
Technical details
The vulnerability is an authentication bypass caused by unrestricted header injection (CWE-290, CWE-807). In versions before 1.22, webhookd converted all HTTP headers to shell variables without validation when the Basic Auth middleware was not configured. While the Basic Auth middleware itself correctly strips and re-injects the X-WebAuthn-User header, disabling authentication leaves this protection inactive. An attacker positioned to inject HTTP headers (via an unsecured upstream reverse proxy or network tampering) can supply arbitrary authentication headers that webhook scripts may trust for privilege elevation or user identification. Attack vector is network-based with no authentication or user interaction required. The fix introduces the WHD_ALLOWED_UPSTREAM_HEADERS configuration to enforce an allowlist of permitted headers, with a secure default that excludes authentication headers. Version 1.22.0 and later are patched.
Affected products
- ncarlier webhookd < 1.22.0
Timeline
- 2026-06-20: disclosed
- 2026-06-20: patched: Version 1.22.0 released with WHD_ALLOWED_UPSTREAM_HEADERS allowlist enforcement
- 2026-09-09: advisory