---
id: "CVE-2026-61576"
kind: "vulnerability"
aliases: ["CVE-2026-61576"]
title: "Lightdash: unauthenticated dbt Cloud webhook lets outsiders trigger preview and path traversal"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["business-intelligence", "dbt-cloud", "lightdash", "package", "self-hosted"]
not_affected_if: ["no-dbt-cloud-ide-project", "version-0.3214.0-or-later", "webhook-not-exposed"]
published_at: "2026-10-29T21:17:27+00:00"
first_seen_at: "2026-10-29T21:26:52+00:00"
updated_at: "2026-10-29T21:28:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61576", "first_seen_at": "2026-10-29T21:26:52+00:00"}]
---

# Lightdash: unauthenticated dbt Cloud webhook lets outsiders trigger preview and path traversal

Lightdash's dbt Cloud webhook endpoint accepts requests with no authentication, and it passes unvalidated account and run identifiers into a server-side dbt Cloud API URL, enabling path traversal and unauthenticated preview creation. The advisory claims API-key theft, but the sources do not establish that an attacker can see the Authorization header.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Lightdash version in use; affected versions are through `0.3213.0`.
- Look at whether any project uses the `dbt Cloud IDE` connection with the webhook route `/api/v1/projects/{projectUuid}/dbt-cloud/webhook` reachable from the internet.
- Check whether a webhook secret is configured for dbt Cloud webhooks; the sources say unsigned webhooks are still processed when no secret is set.

## Fix

- Lightdash: upgrade to `0.3214.0` or later, which fixes identifier path traversal and verifies webhook HMAC signatures when a secret is configured.

## Timeline

- 2026-10-29T21:26:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-61576

## From the sources

Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook `POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook` has no authentication middleware or signature validation. In `packages/backend/src/controllers/projectController.ts`, `testWebhook()` accepts `accountId` and `runId` from a `job.run.completed` request and passes them to `createPreviewWithExplores()` in `packages/backend/src/services/ProjectService/ProjectService.ts`. These unsanitized values are interpolated into the server-side dbt Cloud API URL, which is requested with the victim project's API key in the `Authorization` header. Path traversal through `accountId` changes the requested path on `cloud.getdbt.com` without changing its host, so the credential-bearing request reaches an attacker-influenced path on that fixed host. The advisory claims API-key theft, but the supplied evidence does not establish that the attacker can observe the `Authorization` header. The unauthenticated webhook also allows preview creation. The target must be a `dbt Cloud IDE` project and the attacker must know its `projectUuid`; the UUID is not enumerable but can be discovered in shared or multi-tenant contexts. Version 0.3214.0 fixes identifier path traversal and verifies webhook HMAC signatures only when a secret is configured; without a secret, unsigned webhooks continue to be processed.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_