Path Traversal Issue in Lightdash Business Intelligence Platform

CVE-2026-61576

What is CVE-2026-61576?

A security issue exists in the Lightdash business intelligence platform affecting versions up to 0.3213.0. The vulnerability arises from the lack of authentication middleware and signature validation in the dbt Cloud webhook at the specified endpoint, making it susceptible to path traversal attacks. Unsanitized input from user requests can be manipulated, allowing potential attackers to influence the requested path on the cloud service using the project's API key. Although the advisory claims a risk of API-key theft, the available evidence does not verify that attackers can access the Authorization header directly. The issue is further exacerbated as the unauthenticated webhook enables the creation of previews, requiring only knowledge of the specific projectUuid, which can be discovered in shared environments. This vulnerability was addressed in version 0.3214.0, which implemented fixes for identifier path traversal and added verification for webhook HMAC signatures when a secret is configured.

References