CVE-2026-72846
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored URL directly. The validatePublicHttpUrl helper in packages/backend/src/utils/ssrfProtection.ts, used for MCP server URLs, is not applied on either path, and the webhook fields carry no server-side URL constraint. A user able to create or trigger a scheduled delivery can therefore direct the server to issue POST requests to private, loopback and link-local addresses, including cloud metadata endpoints, and can distinguish reachable internal services from unreachable ones through the resulting errors. The upstream response is never returned to the requester; on a failure status its body is written to the server log instead. Version 1.146.4 routes both clients through postSchedulerWebhook from packages/backend/src/utils/schedulerWebhookValidation rather than calling fetch directly.
Risk Assessment
An attacker can use the server to scan the internal network, access cloud metadata, or perform SSRF attacks, potentially leading to data leakage or compromise of internal services.
Recommendation
Update Lightdash to version 1.146.4 or later, which includes the webhook URL validation fix.
Other vulnerabilities in Lightdash
See all- CVE-2023-35844High
Lightdash versions before 0.510.3 have insecure file endpoints that allow directory traversal and do not ensure that an intended file extension (.csv or .png) is used.
- CVE-2026-61654High
In Lightdash through 0.3213.0, the dbt Cloud webhook POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook has no authentication or signature validation. Unsanitized accountId and runId values are interpolated into the server-side dbt Cloud API URL, which is requested with the victim project's API key in the Authorization header.
- CVE-2026-61576High
The dbt Cloud webhook in Lightdash (POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook) has no authentication middleware or signature validation. The accountId and runId values from the request are interpolated into the server-side dbt Cloud API URL, enabling path traversal and a credential-bearing request using the victim project's API key.
- CVE-2026-108747Medium
Lightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated organization members to delete other users' personal access tokens by supplying their UUID. Attackers can send DELETE requests to the personal-access-tokens route with a victim's token UUID, even across organizations, to revoke it and break API integrations.
Original NVD description (English source)
Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored URL directly. The validatePublicHttpUrl helper in packages/backend/src/utils/ssrfProtection.ts, used for MCP server URLs, is not applied on either path, and the webhook fields carry no server-side URL constraint. A user able to create or trigger a scheduled delivery can therefore direct the server to issue POST requests to private, loopback and link-local addresses, including cloud metadata endpoints, and can distinguish reachable internal services from unreachable ones through the resulting errors. The upstream response is never returned to the requester; on a failure status its body is written to the server log instead. Version 1.146.4 routes both clients through postSchedulerWebhook from packages/backend/src/utils/schedulerWebhookValidation rather than calling fetch directly.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS