Live › vulnerability › CVE-2026-61576
Lightdash's dbt Cloud webhook endpoint accepts requests with no authentication, and it passes unvalidated account and run identifiers into a server-side dbt Cloud API URL, enabling path traversal and unauthenticated preview creation. The advisory claims API-key theft, but the sources do not establish that an attacker can see the Authorization header.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 21:26 UTC. All times on this page are UTC.
Teams running self-hosted Lightdash with a dbt Cloud IDE project connected to the dbt Cloud webhook. The attacker must know the project UUID, which the sources say is not enumerable but can be discovered in shared or multi-tenant contexts. Deployments not using dbt Cloud IDE projects or not exposing the webhook endpoint can likely skip it.
No product ranges from the sources yet.
0.3213.0.dbt Cloud IDE connection with the webhook route /api/v1/projects/{projectUuid}/dbt-cloud/webhook reachable from the internet.0.3214.0 or later, which fixes identifier path traversal and verifies webhook HMAC signatures when a secret is configured.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook has no authentication middleware or signature validation. In packages/backend/src/controllers/projectController.ts, testWebhook() accepts accountId and runId from a job.run.completed request and passes them to createPreviewWithExplores() in packages/backend/src/services/ProjectService/ProjectService.ts. These unsanitized values are interpolated into the server-side dbt Cloud API URL, which is requested with the victim project's API key in the Authorization header. Path traversal through accountId changes the requested path on cloud.getdbt.com without changing its host, so the credential-bearing request reaches an attacker-influenced path on that fixed host. The advisory claims API-key theft, but the supplied evidence does not establish that the attacker can observe the Authorization header. The unauthenticated webhook also allows preview creation. The target must be a dbt Cloud IDE project and the attacker must know its projectUuid; the UUID is not enumerable but can be discovered in shared or multi-tenant contexts. Version 0.3214.0 fixes identifier path traversal and verifies webhook HMAC signatures only when a secret is configured; without a secret, unsigned webhooks continue to be processed.
This page as .md · .json · in your agent: get_signal("CVE-2026-61576")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.