{"id":"CVE-2026-61576","kind":"vulnerability","aliases":["CVE-2026-61576"],"related":[],"title":"Lightdash: unauthenticated dbt Cloud webhook lets outsiders trigger preview and path traversal","description":"Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook `POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook` has no authentication middleware or signature validation. In `packages/backend/src/controllers/projectController.ts`, `testWebhook()` accepts `accountId` and `runId` from a `job.run.completed` request and passes them to `createPreviewWithExplores()` in `packages/backend/src/services/ProjectService/ProjectService.ts`. These unsanitized values are interpolated into the server-side dbt Cloud API URL, which is requested with the victim project's API key in the `Authorization` header. Path traversal through `accountId` changes the requested path on `cloud.getdbt.com` without changing its host, so the credential-bearing request reaches an attacker-influenced path on that fixed host. The advisory claims API-key theft, but the supplied evidence does not establish that the attacker can observe the `Authorization` header. The unauthenticated webhook also allows preview creation. The target must be a `dbt Cloud IDE` project and the attacker must know its `projectUuid`; the UUID is not enumerable but can be discovered in shared or multi-tenant contexts. Version 0.3214.0 fixes identifier path traversal and verifies webhook HMAC signatures only when a secret is configured; without a secret, unsigned webhooks continue to be processed.","summary":"Lightdash's dbt Cloud webhook endpoint accepts requests with no authentication, and it passes unvalidated account and run identifiers into a server-side dbt Cloud API URL, enabling path traversal and unauthenticated preview creation. The advisory claims API-key theft, but the sources do not establish that an attacker can see the Authorization header.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["business-intelligence","dbt-cloud","lightdash","package","self-hosted"],"not_affected_if":["no-dbt-cloud-ide-project","version-0.3214.0-or-later","webhook-not-exposed"],"how_to_check":"- Check the Lightdash version in use; affected versions are through `0.3213.0`.\n- Look at whether any project uses the `dbt Cloud IDE` connection with the webhook route `/api/v1/projects/{projectUuid}/dbt-cloud/webhook` reachable from the internet.\n- Check whether a webhook secret is configured for dbt Cloud webhooks; the sources say unsigned webhooks are still processed when no secret is set.","fix":"- Lightdash: upgrade to `0.3214.0` or later, which fixes identifier path traversal and verifies webhook HMAC signatures when a secret is configured.","status":"open","published_at":"2026-10-29T21:17:27+00:00","first_seen_at":"2026-10-29T21:26:52+00:00","triaged_at":"2026-10-29T21:28:34+00:00","updated_at":"2026-10-29T21:28:34+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T21:28:34Z","model":"claude-haiku-5-5","output":{"fix":"- Lightdash: upgrade to `0.3214.0` or later, which fixes identifier path traversal and verifies webhook HMAC signatures when a secret is configured.","reach":"internet","title":"Lightdash: unauthenticated dbt Cloud webhook lets outsiders trigger preview and path traversal","impact":"medium","summary":"Lightdash's dbt Cloud webhook endpoint accepts requests with no authentication, and it passes unvalidated account and run identifiers into a server-side dbt Cloud API URL, enabling path traversal and unauthenticated preview creation. The advisory claims API-key theft, but the sources do not establish that an attacker can see the Authorization header.","audience":"businesses","category":"package","nicknames":[],"who_cares":["lightdash","self-hosted","dbt-cloud","business-intelligence"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated webhook triggers previews and path traversal to dbt Cloud","analyst_note":"Confirm whether the Authorization header can be observed by an attacker, as the advisory's API-key theft claim is not established by the supplied evidence; check the NVD and advisory pages for the claim.","how_to_check":"- Check the Lightdash version in use; affected versions are through `0.3213.0`.\n- Look at whether any project uses the `dbt Cloud IDE` connection with the webhook route `/api/v1/projects/{projectUuid}/dbt-cloud/webhook` reachable from the internet.\n- Check whether a webhook secret is configured for dbt Cloud webhooks; the sources say unsigned webhooks are still processed when no secret is set.","plain_action":"","needs_analyst":true,"not_affected_if":["no-dbt-cloud-ide-project","webhook-not-exposed","version-0.3214.0-or-later"],"who_is_affected":"Teams running self-hosted Lightdash with a dbt Cloud IDE project connected to the dbt Cloud webhook. The attacker must know the project UUID, which the sources say is not enumerable but can be discovered in shared or multi-tenant contexts. Deployments not using dbt Cloud IDE projects or not exposing the webhook endpoint can likely skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000858,"input_tokens":4491,"output_tokens":817,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-61576':15A,18A '/api/v1/projects':104C '/dbt-cloud/webhook':106C '0.3213.0':98C '0.3214.0':252C 'accept':36B,117C 'account':45B 'accountid':118C,163C 'advisori':66B,191C 'affect':95C 'allow':216C 'also':215C 'api':56B,69B,144C,154C,194C 'api-key':68B,193C 'attack':80B,183C,206C,230C 'attacker-influenc':182C 'authent':40B,109C 'author':84B,158C,210C 'bear':178C 'busi':20B,91C 'business-intellig':19B 'chang':164C,171C 'claim':67B,192C 'cloud':4A,24B,33B,55B,101C,143C,225C 'cloud.getdbt.com':169C 'configur':267C 'context':250C 'continu':273C 'createpreviewwithexplor':129C 'creation':64B,218C 'credenti':177C 'credential-bear':176C 'cve':13A,16A 'dbt':3A,23B,32B,54B,100C,142C,224C 'dbt-cloud':22B 'discov':243C 'enabl':58B 'endpoint':35B 'enumer':239C 'establish':77B,203C 'evid':200C 'fix':188C,253C 'header':85B,159C,211C 'hmac':260C 'host':29B,173C,189C 'ide':226C 'identifi':48B,254C 'influenc':184C 'intellig':21B,92C 'interpol':136C 'job.run.completed':123C 'key':70B,155C,195C 'know':232C 'let':6A 'lightdash':1A,25B,30B,86C 'middlewar':110C 'multi':248C 'multi-ten':247C 'must':221C,231C 'observ':208C 'open':89C 'outsid':7A 'packag':26B 'packages/backend/src/controllers/projectcontroller.ts':115C 'packages/backend/src/services/projectservice/projectservice.ts':131C 'pass':43B,126C 'path':11A,59B,160C,167C,185C,255C 'platform':93C 'post':103C 'preview':9A,63B,217C 'process':276C 'project':152C,227C 'projectuuid':105C,234C 'reach':180C 'request':37B,124C,148C,166C,179C 'run':47B 'runid':120C 'secret':265C,270C 'see':82B 'self':28B 'self-host':27B 'server':52B,140C 'server-sid':51B,139C 'share':245C 'side':53B,141C 'signatur':112C,261C 'sourc':74B,90C 'suppli':199C 'target':220C 'tenant':249C 'testwebhook':116C 'theft':71B,196C 'travers':12A,60B,161C,256C 'trigger':8A 'unauthent':2A,62B,213C 'unsanit':133C 'unsign':271C 'unvalid':44B 'url':57B,145C 'uuid':236C 'valid':113C 'valu':134C 'verifi':258C 'version':96C,251C 'victim':151C 'webhook':5A,34B,102C,214C,259C,272C 'without':170C,268C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Lightdash with a dbt Cloud IDE project connected to the dbt Cloud webhook. The attacker must know the project UUID, which the sources say is not enumerable but can be discovered in shared or multi-tenant contexts. Deployments not using dbt Cloud IDE projects or not exposing the webhook endpoint can likely skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T21:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61576","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61576","severity":null,"published_at":"2026-10-29T21:17:27+00:00","modified_at":"2026-10-29T21:17:27+00:00","first_seen_at":"2026-10-29T21:26:52+00:00","fetched_at":"2026-10-29T21:26:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}