# CVE-2026-61576: Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key

> CVE-2026-61576: Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key. CVSS 8.3 (CVSS 4.0).

Canonical: https://rewindex.com/cve/CVE-2026-61576
Last updated: 2026-10-30T16:17:57Z

- Published: 2026-10-29 21:00 UTC · Updated: 2026-10-30 16:17 UTC · Assigner: GitHub\_M
- CVSS: 8.3 (CVSS 4.0) · Severity: High
- EPSS: 0.45%, 39th percentile (scored 2026-11-05)
- CISA KEV: no
- CWE: CWE-22

## Description

Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook \`POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook\` has no authentication middleware or signature validation. In \`packages/backend/src/controllers/projectController.ts\`, \`testWebhook()\` accepts \`accountId\` and \`runId\` from a \`job.run.completed\` request and passes them to \`createPreviewWithExplores()\` in \`packages/backend/src/services/ProjectService/ProjectService.ts\`. These unsanitized values are interpolated into the server-side dbt Cloud API URL, which is requested with the victim project's API key in the \`Authorization\` header. Path traversal through \`accountId\` changes the requested path on \`cloud.getdbt.com\` without changing its host, so the credential-bearing request reaches an attacker-influenced path on that fixed host. The advisory claims API-key theft, but the supplied evidence does not establish that the attacker can observe the \`Authorization\` header. The unauthenticated webhook also allows preview creation. The target must be a \`dbt Cloud IDE\` project and the attacker must know its \`projectUuid\`; the UUID is not enumerable but can be discovered in shared or multi-tenant contexts. Version 0.3214.0 fixes identifier path traversal and verifies webhook HMAC signatures only when a secret is configured; without a secret, unsigned webhooks continue to be processed.

## Affected vendors and products

- lightdash: lightdash

## Tracked companies

- [Lightdash](https://rewindex.com/company/lightdash.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-61576)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-61576)
- [https://github.com/lightdash/lightdash/commit/8d1d9bb6804bbea66a7bdf1b9b00092665382f14](https://github.com/lightdash/lightdash/commit/8d1d9bb6804bbea66a7bdf1b9b00092665382f14)
- [https://github.com/lightdash/lightdash/pull/24587](https://github.com/lightdash/lightdash/pull/24587)
- [https://github.com/lightdash/lightdash/releases/tag/0.3214.0](https://github.com/lightdash/lightdash/releases/tag/0.3214.0)
- [https://github.com/lightdash/lightdash/security/advisories/GHSA-3594-hhm2-76fj](https://github.com/lightdash/lightdash/security/advisories/GHSA-3594-hhm2-76fj)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-61576 · Markdown: https://rewindex.com/cve/CVE-2026-61576.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-61576 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-05T16:47:04.098Z