Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-61576— Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key

Quick assessment

Affected
lightdash lightdash
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Lightdash 是一个开源的商业智能（BI）平台。在受影响且版本号为 0.3213.0 及以下的版本中，dbt Cloud 的 Webhook 接口 缺少身份验证中间件和签名验证机制。在 文件中， 函数会从 请求中接受 和 参数，并将它们传递给位于 中的 函数。这些未经净化的值被直接拼接到服务端构建的 dbt Cloud API 请求 URL 中，随后该请求会使用受害项目的 API 密钥作为 请求头发起。攻击者可通过在 参数中利用路径遍历漏洞，改变 域名下的请求路径，而保持主机名不变，从而使携带凭证的请求被导向

CVSS 8.3 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61576

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key
Source: CVE Program / CVE List V5
Vulnerability Description
Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook `POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook` has no authentication middleware or signature validation. In `packages/backend/src/controllers/projectController.ts`, `testWebhook()` accepts `accountId` and `runId` from a `job.run.completed` request and passes them to `createPreviewWithExplores()` in `packages/backend/src/services/ProjectService/ProjectService.ts`. These unsanitized values are interpolated into the server-side dbt Cloud API URL, which is requested with the victim project's API key in the `Authorization` header. Path traversal through `accountId` changes the requested path on `cloud.getdbt.com` without changing its host, so the credential-bearing request reaches an attacker-influenced path on that fixed host. The advisory claims API-key theft, but the supplied evidence does not establish that the attacker can observe the `Authorization` header. The unauthenticated webhook also allows preview creation. The target must be a `dbt Cloud IDE` project and the attacker must know its `projectUuid`; the UUID is not enumerable but can be discovered in shared or multi-tenant contexts. Version 0.3214.0 fixes identifier path traversal and verifies webhook HMAC signatures only when a secret is configured; without a secret, unsigned webhooks continue to be processed.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
lightdash lightdash < 0.3214.0 -

II. Public POCs for CVE-2026-61576

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61576

请登录查看更多情报信息。

Other References for CVE-2026-61576 (4)

IV. Related Vulnerabilities

Same product: lightdash
Same vendor: lightdash
Same weakness: CWE-22