Unauthenticated Webhook Vulnerability in Lightdash Business Intelligence Platform
CVE-2026-61654
What is CVE-2026-61654?
The Lightdash platform, a popular open-source business intelligence tool, exhibits a vulnerability through its webhook implementation. Versions prior to 0.3214.0 are affected by a lack of authentication on the dbt Cloud webhook, which allows for unauthorized access. The webhook does not validate incoming requests, enabling path traversal attacks through unsanitized values such as accountId and runId. This could potentially lead to an attacker gaining unauthorized access to sensitive API calls. Although the platform is primarily designed to handle specific project requests, the discovery of projectUuid within shared environments facilitates exploitation. Even though fixes have been implemented starting from version 0.3214.0 that address path traversal and enhance verification for webhooks using configured secrets, those relying on previous versions remain vulnerable to exploitation.
Affected Version(s)
lightdash < 0.3214.0