# User-controlled value into privileged sink

User-influenced URL, ref, path, or header reaching shell, git, loader, or auth gate unvalidated

_Area: Web authentication and account takeover. Seen in 4 disclosed reports; one confirmed bounty: $20,000; latest 2026-10-08. Updated 2026-10-23._

## How it works
A value the user can influence (a URL, branch name, query parameter, annotation, database name, or request header) is passed into a privileged operation — a shell command, a git subcommand, a config loader, a connection-string parser, or an auth decision — without validation or separation from the surrounding syntax. The code assumes the value is inert data, but the sink reinterprets it as options, paths, connection parameters, or trust signals. The broken assumption is "this string is just a name/path/URL/host"; the sink's own grammar then gives the attacker control over where files are written, which host is contacted, which code is loaded, or whether a gate passes.

## Where it shows up
- User-controlled commitish/branch/tag values reaching `git diff-tree`, `git log`, etc. without a `--` separator or leading-dash check [E1](https://bugbountylibrary.com/r/blog%3Adevcraft-io-2020-10-18-github-rce-git-inject-html.md)
- User-controlled dbname/username/backupFile passed to `pg_dump`/`pg_restore` where libpq connection-string syntax can override hardcoded `-h localhost` [E2](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce.md)
- Attacker-controlled fields written into a session/config file without CRLF filtering, letting raw `\r\n` create new records [E3](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-4194.md)
- Auth gates that decide "is this local/trusted?" from `request.url.hostname`, `Host`, `X-Forwarded-For`, or `Origin` instead of a server-owned bind/socket property [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-2gpf-2492-q9jh.md)
- Ingress annotations/UIDs assembled into a config then run through a validator binary (`nginx -t`)
- Any component that shells out to a linter/validator on attacker-influenced input

## How to review
Trace each user-influenced value to every sink. The invariant: a value must be either (a) strictly validated against an allowlist of safe characters/shape (e.g. branch names matching `^[A-Za-z0-9._/-]+$` with no leading `-`), or (b) passed as a separate argument after a `--`/end-of-options marker, or (c) escaped for the sink's exact grammar. Check that hardcoded flags cannot be overridden by the value's own syntax (connection strings, option prefixes). For trust gates, confirm the decision reads a server-owned property (actual bind address, socket peer), not client-supplied request metadata [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-2gpf-2492-q9jh.md). For file writers, confirm every field is encoded or filtered before it lands on disk [E3](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-4194.md).

## Variants seen
- Git option injection via branch name lacking `--` separator, `--output` writing into sourced scripts [E1](https://bugbountylibrary.com/r/blog%3Adevcraft-io-2020-10-18-github-rce-git-inject-html.md)
- Connection-string injection overriding hardcoded host in pg_dump/pg_restore [E2](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce.md)
- CRLF injection into a session file forging privileged records [E3](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-4194.md)
- Host-header spoofing defeating a localhost-only auth guard [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-2gpf-2492-q9jh.md)
- Config injection via Ingress annotations escalated through validator module loading

## Why fixes fail
Blocklisting a single connector/feature name leaves sibling types reaching the same sink; decompile the dispatch layer to find them. A guard added inside a sink is bypassed by callers that invoke the sink directly, skipping the wrapper [E3](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-4194.md). A patched auth guard that still reads request metadata (Host) remains spoofable [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-2gpf-2492-q9jh.md).

## Impact and severity
Led to RCE, pre-auth RCE, authentication bypass, and forged privileged sessions [E1](https://bugbountylibrary.com/r/blog%3Adevcraft-io-2020-10-18-github-rce-git-inject-html.md)[E2](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce.md)[E3](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-4194.md)[E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-2gpf-2492-q9jh.md). Severity is highest when the sink is reachable pre-auth or from a shared/multi-tenant runtime, and when the compromised identity holds broad permissions [E1](https://bugbountylibrary.com/r/blog%3Adevcraft-io-2020-10-18-github-rce-git-inject-html.md)[E2](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Adevcraft-io-2020-10-18-github-rce-git-inject-html.md
- E2: https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce.md
- E3: https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-4194.md
- E4: https://bugbountylibrary.com/r/ghsa%3AGHSA-2gpf-2492-q9jh.md