GitHub 在 Webhook 调用中泄露了 Webhook 密钥
3 分•作者: time4tea•4 个月前
无法在网页上看到此内容…
来自一封电子邮件：
我们写信通知您，在 2025 年 9 月至 2026 年 1 月期间，您负责的 webhook 的 webhook 密钥被无意中包含在 webhook 传递的 HTTP 标头中。这意味着在此期间接收 webhook 负载的任何系统都可能已从请求标头中记录了 webhook 密钥。Webhook 传递通过 TLS 在传输过程中进行加密，因此包含密钥的标头仅以 base64 编码格式供接收端点访问。我们没有任何证据表明您的密钥被拦截。此问题已于 2026 年 1 月 26 日修复。请继续阅读以获取更多信息。
用户隐私和安全对于维护信任至关重要，我们希望尽可能透明地公开此类事件。GitHub 本身并未因此事件而遭受任何入侵或数据泄露。
* 发生了什么？*
2026 年 1 月 26 日，GitHub 发现了一个新版 webhook 传递平台中的一个错误，该错误导致 webhook 密钥被包含在与 webhook 负载一起发送的 X-Github-Encoded-Secret HTTP 标头中。此标头不应作为传递的一部分，并使 webhook 密钥以 base64 编码格式提供给接收端点。Webhook 密钥用于验证传递确实来自 GitHub，并且应该仅为 GitHub 和 webhook 所有者所知。
该错误仅限于使用此新版 webhook 平台的 webhook 传递的子集。该错误存在于 2025 年 9 月 11 日至 2025 年 12 月 10 日期间，并在 2026 年 1 月 5 日短暂出现。该错误已于 2026 年 1 月 26 日修复。
查看原文
Couldn't see this on a Web page...<p>From an email:<p>We're writing to let you know that between September 2025 and January 2026, webhook secrets for webhooks you are responsible for were inadvertently included in an HTTP header on webhook deliveries. This means that any system receiving webhook payloads during this window could have logged the webhook secret from the request headers. Webhook deliveries are encrypted in transit via TLS, so the header containing the secret was only accessible to the receiving endpoint in a base64-encoded format. We have no evidence to suggest your secrets were intercepted. This issue was fixed on January 26, 2026. Please read on for more information.<p>User privacy and security are essential for maintaining trust, and we want to remain as transparent as possible about events like these. GitHub itself did not experience a compromise or data breach as a result of this event.<p>* What happened? *<p>On January 26, 2026, GitHub identified a bug in a new version of the webhook delivery platform where webhook secrets were included in an X-Github-Encoded-Secret HTTP header sent with webhook payloads. This header was not intended to be part of the delivery and made the webhook secret available to the receiving endpoint in a base64-encoded format. Webhook secrets are used to verify that deliveries are genuinely from GitHub, and should only be known to GitHub and the webhook owner.<p>The bug was limited to only a subset of webhook deliveries that were feature flagged to use this new version of the webhooks platform. The bug was present between September 11, 2025, and December 10, 2025, and briefly on January 5, 2026. The bug was fixed on January 26, 2026