Vulnerability-Lookup

CVE-2026-59157 (GCVE-0-2026-59157)

Vulnerability from cvelistv5 – Published: 2026-09-15 15:46 – Updated: 2026-09-16 15:38

Title

webhookd: Unrestricted HTTP Header to Shell Variable Injection

Summary

webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP requests. Prior to 1.22.0, webhookd deployments without htpasswd authentication forwarded all incoming HTTP headers through HTTPParamsToShellVars in pkg/api/index.go into the hook script environment without an allowlist. When an upstream reverse proxy did not strip a client-supplied X-WebAuthn-User header and a hook script trusted that variable for identity or privilege, a remote unauthenticated attacker could spoof another user, bypass script security controls, and access or modify resources available to the impersonated identity. This issue is fixed in version 1.22.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 15:38 UTC

CWE

CWE-290 - Authentication Bypass by Spoofing
CWE-807 - Reliance on Untrusted Inputs in a Security Decision

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/ncarlier/webhookd/security/adv…	x_refsource_CONFIRM
https://github.com/ncarlier/webhookd/pull/121	x_refsource_MISC
https://github.com/ncarlier/webhookd/commit/5ac66…	x_refsource_MISC
https://github.com/ncarlier/webhookd/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
ncarlier	webhookd	Affected: < 1.22	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59157",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T15:38:31.622911Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T15:38:42.407Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "webhookd",
          "vendor": "ncarlier",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.22"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP requests. Prior to 1.22.0, webhookd deployments without htpasswd authentication forwarded all incoming HTTP headers through HTTPParamsToShellVars in pkg/api/index.go into the hook script environment without an allowlist. When an upstream reverse proxy did not strip a client-supplied X-WebAuthn-User header and a hook script trusted that variable for identity or privilege, a remote unauthenticated attacker could spoof another user, bypass script security controls, and access or modify resources available to the impersonated identity. This issue is fixed in version 1.22.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290: Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-807",
              "description": "CWE-807: Reliance on Untrusted Inputs in a Security Decision",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T15:46:35.418Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/ncarlier/webhookd/security/advisories/GHSA-v25g-mvwr-f5fp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/ncarlier/webhookd/security/advisories/GHSA-v25g-mvwr-f5fp"
        },
        {
          "name": "https://github.com/ncarlier/webhookd/pull/121",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ncarlier/webhookd/pull/121"
        },
        {
          "name": "https://github.com/ncarlier/webhookd/commit/5ac66677bf7224191f1dfc51a875b09187d10beb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ncarlier/webhookd/commit/5ac66677bf7224191f1dfc51a875b09187d10beb"
        },
        {
          "name": "https://github.com/ncarlier/webhookd/releases/tag/v1.22.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ncarlier/webhookd/releases/tag/v1.22.0"
        }
      ],
      "source": {
        "advisory": "GHSA-v25g-mvwr-f5fp",
        "discovery": "UNKNOWN"
      },
      "title": "webhookd: Unrestricted HTTP Header to Shell Variable Injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59157",
    "datePublished": "2026-09-15T15:46:35.418Z",
    "dateReserved": "2026-07-02T16:50:27.887Z",
    "dateUpdated": "2026-09-16T15:38:42.407Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-59157",
      "date": "2026-09-16",
      "epss": "0.00461",
      "percentile": "0.38982"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-59157\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-09-15T16:17:16.957\",\"lastModified\":\"2026-09-16T16:17:13.713\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP requests. Prior to 1.22.0, webhookd deployments without htpasswd authentication forwarded all incoming HTTP headers through HTTPParamsToShellVars in pkg/api/index.go into the hook script environment without an allowlist. When an upstream reverse proxy did not strip a client-supplied X-WebAuthn-User header and a hook script trusted that variable for identity or privilege, a remote unauthenticated attacker could spoof another user, bypass script security controls, and access or modify resources available to the impersonated identity. This issue is fixed in version 1.22.0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"ncarlier\",\"product\":\"webhookd\",\"versions\":[{\"version\":\"\u003c 1.22\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":2.5}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-16T15:38:31.622911Z\",\"id\":\"CVE-2026-59157\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-290\"},{\"lang\":\"en\",\"value\":\"CWE-807\"}]}],\"references\":[{\"url\":\"https://github.com/ncarlier/webhookd/commit/5ac66677bf7224191f1dfc51a875b09187d10beb\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/ncarlier/webhookd/pull/121\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/ncarlier/webhookd/releases/tag/v1.22.0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/ncarlier/webhookd/security/advisories/GHSA-v25g-mvwr-f5fp\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"webhookd: Unrestricted HTTP Header to Shell Variable Injection\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-290\", \"lang\": \"en\", \"description\": \"CWE-290: Authentication Bypass by Spoofing\", \"type\": \"CWE\"}]}, {\"descriptions\": [{\"cweId\": \"CWE-807\", \"lang\": \"en\", \"description\": \"CWE-807: Reliance on Untrusted Inputs in a Security Decision\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"NONE\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\", \"version\": \"3.1\"}}], \"references\": [{\"name\": \"https://github.com/ncarlier/webhookd/security/advisories/GHSA-v25g-mvwr-f5fp\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/ncarlier/webhookd/security/advisories/GHSA-v25g-mvwr-f5fp\"}, {\"name\": \"https://github.com/ncarlier/webhookd/pull/121\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/ncarlier/webhookd/pull/121\"}, {\"name\": \"https://github.com/ncarlier/webhookd/commit/5ac66677bf7224191f1dfc51a875b09187d10beb\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/ncarlier/webhookd/commit/5ac66677bf7224191f1dfc51a875b09187d10beb\"}, {\"name\": \"https://github.com/ncarlier/webhookd/releases/tag/v1.22.0\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/ncarlier/webhookd/releases/tag/v1.22.0\"}], \"affected\": [{\"vendor\": \"ncarlier\", \"product\": \"webhookd\", \"versions\": [{\"version\": \"\u003c 1.22\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-09-15T15:46:35.418Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP requests. Prior to 1.22.0, webhookd deployments without htpasswd authentication forwarded all incoming HTTP headers through HTTPParamsToShellVars in pkg/api/index.go into the hook script environment without an allowlist. When an upstream reverse proxy did not strip a client-supplied X-WebAuthn-User header and a hook script trusted that variable for identity or privilege, a remote unauthenticated attacker could spoof another user, bypass script security controls, and access or modify resources available to the impersonated identity. This issue is fixed in version 1.22.0.\"}], \"source\": {\"advisory\": \"GHSA-v25g-mvwr-f5fp\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-59157\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-16T15:38:31.622911Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-16T15:38:38.935Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-59157\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2026-07-02T16:50:27.887Z\", \"datePublished\": \"2026-09-15T15:46:35.418Z\", \"dateUpdated\": \"2026-09-16T15:38:42.407Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-59157

Vulnerability from fkie_nvd - Published: 2026-09-15 16:17 - Updated: 2026-09-16 16:17

Severity

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/ncarlier/webhookd/commit/5ac66677bf7224191f1dfc51a875b09187d10beb
	security-advisories@github.com	https://github.com/ncarlier/webhookd/pull/121
	security-advisories@github.com	https://github.com/ncarlier/webhookd/releases/tag/v1.22.0
	security-advisories@github.com	https://github.com/ncarlier/webhookd/security/advisories/GHSA-v25g-mvwr-f5fp

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "webhookd",
          "vendor": "ncarlier",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.22"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP requests. Prior to 1.22.0, webhookd deployments without htpasswd authentication forwarded all incoming HTTP headers through HTTPParamsToShellVars in pkg/api/index.go into the hook script environment without an allowlist. When an upstream reverse proxy did not strip a client-supplied X-WebAuthn-User header and a hook script trusted that variable for identity or privilege, a remote unauthenticated attacker could spoof another user, bypass script security controls, and access or modify resources available to the impersonated identity. This issue is fixed in version 1.22.0."
    }
  ],
  "id": "CVE-2026-59157",
  "lastModified": "2026-09-16T16:17:13.713",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-59157",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-16T15:38:31.622911Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-15T16:17:16.957",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ncarlier/webhookd/commit/5ac66677bf7224191f1dfc51a875b09187d10beb"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ncarlier/webhookd/pull/121"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ncarlier/webhookd/releases/tag/v1.22.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ncarlier/webhookd/security/advisories/GHSA-v25g-mvwr-f5fp"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-290"
        },
        {
          "lang": "en",
          "value": "CWE-807"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-V25G-MVWR-F5FP

Vulnerability from github – Published: 2026-09-09 23:47 – Updated: 2026-09-09 23:47

Summary

webhookd: Unrestricted HTTP Header to Shell Variable Injection

Details

Description

Before 1.22, if the Basic Auth (htpasswd) middleware was not configured, all incoming HTTP headers were blindly forwarded to the webhook script execution environment as shell variables. While the Basic Auth middleware correctly strips the authentication header (X-WebAuthn-User) from the incoming request before conditionally re-injecting it on successful authentication, disabling Basic Auth left the system vulnerable if deployed behind an unhardened reverse proxy.

Impact

If an upstream reverse proxy is not properly hardened to strip client-provided authentication headers, an attacker could manually supply these headers (e.g., X-WebAuthn-User). A webhook script relying on this forwarded header for privilege elevation or identity verification could therefore be exploited to bypass security controls and impersonate other users.

Mitigation

The WHD_ALLOWED_UPSTREAM_HEADERS configuration setting has been introduced to enforce a strict allowlist of HTTP headers that can be converted into shell variables.

Additionally, the default behavior has been changed to adhere to the principle of least privilege. It is no longer * (allow all). The default allowed headers are now restricted to standard operational headers: Accept,Content-Type,Content-Length,User-Agent,X-Forwarded-For

Administrators relying on upstream authentication proxies must explicitly add their authentication headers (e.g., WHD_ALLOWED_UPSTREAM_HEADERS="Accept,Content-Type,Content-Length,User-Agent,X-Forwarded-For,x-webauthn-user") to ensure they are passed to the scripts securely.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/ncarlier/webhookd"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.22.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59157"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-290",
      "CWE-807"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-09T23:47:03Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Description\nBefore 1.22, if the Basic Auth (`htpasswd`) middleware was not configured, all incoming HTTP headers were blindly forwarded to the webhook script execution environment as shell variables. While the Basic Auth middleware correctly strips the authentication header (`X-WebAuthn-User`) from the incoming request before conditionally re-injecting it on successful authentication, disabling Basic Auth left the system vulnerable if deployed behind an unhardened reverse proxy.\n\n## Impact\nIf an upstream reverse proxy is not properly hardened to strip client-provided authentication headers, an attacker could manually supply these headers (e.g., `X-WebAuthn-User`). A webhook script relying on this forwarded header for privilege elevation or identity verification could therefore be exploited to bypass security controls and impersonate other users.\n\n## Mitigation\nThe `WHD_ALLOWED_UPSTREAM_HEADERS` configuration setting has been introduced to enforce a strict allowlist of HTTP headers that can be converted into shell variables. \n\nAdditionally, the default behavior has been changed to adhere to the principle of least privilege. It is no longer `*` (allow all). The default allowed headers are now restricted to standard operational headers:\n`Accept,Content-Type,Content-Length,User-Agent,X-Forwarded-For`\n\nAdministrators relying on upstream authentication proxies must explicitly add their authentication headers (e.g., `WHD_ALLOWED_UPSTREAM_HEADERS=\"Accept,Content-Type,Content-Length,User-Agent,X-Forwarded-For,x-webauthn-user\"`) to ensure they are passed to the scripts securely.",
  "id": "GHSA-v25g-mvwr-f5fp",
  "modified": "2026-09-09T23:47:03Z",
  "published": "2026-09-09T23:47:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ncarlier/webhookd/security/advisories/GHSA-v25g-mvwr-f5fp"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ncarlier/webhookd"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ncarlier/webhookd/releases/tag/v1.22.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "webhookd: Unrestricted HTTP Header to Shell Variable Injection"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-59157 (GCVE-0-2026-59157)

FKIE_CVE-2026-59157

GHSA-V25G-MVWR-F5FP

Description

Impact

Mitigation

Tags

Sightings

Nomenclature

Related by attack behaviour