{"id":"CVE-2026-61654","kind":"vulnerability","aliases":["CVE-2026-61654"],"related":[],"title":"Lightdash: unauthenticated dbt Cloud webhook lets outsiders trigger preview creation","description":"Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook `POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook` has no authentication middleware or signature validation. In `packages/backend/src/controllers/projectController.ts`, `testWebhook()` accepts `accountId` and `runId` from a `job.run.completed` request and passes them to `createPreviewWithExplores()` in `packages/backend/src/services/ProjectService/ProjectService.ts`. These unsanitized values are interpolated into the server-side dbt Cloud API URL, which is requested with the victim project's API key in the `Authorization` header. Path traversal through `accountId` changes the requested path on `cloud.getdbt.com` without changing its host, so the credential-bearing request reaches an attacker-influenced path on that fixed host. The advisory claims API-key theft, but the supplied evidence does not establish that the attacker can observe the `Authorization` header. The unauthenticated webhook also allows preview creation. The target must be a `dbt Cloud IDE` project and the attacker must know its `projectUuid`; the UUID is not enumerable but can be discovered in shared or multi-tenant contexts. Version 0.3214.0 fixes identifier path traversal and verifies webhook HMAC signatures only when a secret is configured; without a secret, unsigned webhooks continue to be processed.","summary":"Lightdash's dbt Cloud webhook endpoint has no authentication or signature check, so anyone who knows a project's UUID can post to it and create previews. Path traversal through the accountId and runId values can also change the URL that Lightdash requests from cloud.getdbt.com with the project's API key in the Authorization header.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dbt-cloud","lightdash","other","self-hosted"],"not_affected_if":["no-dbt-cloud-webhook","not-dbt-cloud-ide","version-0.3214.0-or-later"],"how_to_check":"- Check the Lightdash version the team runs; versions through `0.3213.0` are affected.\n- Check whether any project uses a `dbt Cloud IDE` connection with the dbt Cloud webhook `POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook` enabled.\n- Check whether a webhook secret is configured for those projects; without one, unsigned webhooks are still processed.","fix":"- Lightdash: upgrade to `0.3214.0` or later, which fixes the identifier path traversal and verifies webhook HMAC signatures when a secret is configured.","status":"open","published_at":"2026-10-29T22:17:05+00:00","first_seen_at":"2026-10-29T22:27:06+00:00","triaged_at":"2026-10-29T22:28:45+00:00","updated_at":"2026-10-29T22:28:45+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-29T22:28:45Z","model":"claude-haiku-5-5","output":{"fix":"- Lightdash: upgrade to `0.3214.0` or later, which fixes the identifier path traversal and verifies webhook HMAC signatures when a secret is configured.","reach":"internet","title":"Lightdash: unauthenticated dbt Cloud webhook lets outsiders trigger preview creation","impact":"medium","summary":"Lightdash's dbt Cloud webhook endpoint has no authentication or signature check, so anyone who knows a project's UUID can post to it and create previews. Path traversal through the accountId and runId values can also change the URL that Lightdash requests from cloud.getdbt.com with the project's API key in the Authorization header.","audience":"businesses","category":"other","nicknames":[],"who_cares":["lightdash","dbt-cloud","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Outsiders create previews; API key exposure is claimed but unconfirmed","analyst_note":"Check the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-61654 and verify the advisory's API-key theft claim against testWebhook() in projectController.ts, since the supplied evidence does not show the attacker can see the Authorization header.","how_to_check":"- Check the Lightdash version the team runs; versions through `0.3213.0` are affected.\n- Check whether any project uses a `dbt Cloud IDE` connection with the dbt Cloud webhook `POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook` enabled.\n- Check whether a webhook secret is configured for those projects; without one, unsigned webhooks are still processed.","plain_action":"","needs_analyst":true,"not_affected_if":["version-0.3214.0-or-later","no-dbt-cloud-webhook","not-dbt-cloud-ide"],"who_is_affected":"Teams running self-hosted or shared Lightdash at or before 0.3213.0 that connect a dbt Cloud IDE project through the dbt Cloud webhook. Exposure also depends on an attacker knowing the project UUID, which is not enumerable but can leak in shared or multi-tenant setups. Teams on 0.3214.0 or later, or without the dbt Cloud webhook, can skip this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.001445,"input_tokens":4491,"output_tokens":1992,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-61654':13A,16A '/api/v1/projects':98C '/dbt-cloud/webhook':100C '0.3213.0':92C '0.3214.0':246C 'accept':111C 'accountid':56B,112C,157C 'advisori':185C 'affect':89C 'allow':210C 'also':61B,209C 'anyon':38B 'api':74B,138C,148C,188C 'api-key':187C 'attack':177C,200C,224C 'attacker-influenc':176C 'authent':33B,103C 'author':78B,152C,204C 'bear':172C 'busi':85C 'chang':62B,158C,165C 'check':36B 'claim':186C 'cloud':4A,19B,28B,95C,137C,219C 'cloud.getdbt.com':69B,163C 'configur':261C 'context':244C 'continu':267C 'creat':50B 'createpreviewwithexplor':123C 'creation':10A,212C 'credenti':171C 'credential-bear':170C 'cve':11A,14A 'dbt':3A,18B,27B,94C,136C,218C 'dbt-cloud':17B 'discov':237C 'endpoint':30B 'enumer':233C 'establish':197C 'evid':194C 'fix':182C,247C 'header':79B,153C,205C 'hmac':254C 'host':24B,167C,183C 'ide':220C 'identifi':248C 'influenc':178C 'intellig':86C 'interpol':130C 'job.run.completed':117C 'key':75B,149C,189C 'know':40B,226C 'let':6A 'lightdash':1A,20B,25B,66B,80C 'middlewar':104C 'multi':242C 'multi-ten':241C 'must':215C,225C 'observ':202C 'open':83C 'outsid':7A 'packages/backend/src/controllers/projectcontroller.ts':109C 'packages/backend/src/services/projectservice/projectservice.ts':125C 'pass':120C 'path':52B,154C,161C,179C,249C 'platform':87C 'post':46B,97C 'preview':9A,51B,211C 'process':270C 'project':42B,72B,146C,221C 'projectuuid':99C,228C 'reach':174C 'request':67B,118C,142C,160C,173C 'runid':58B,114C 'secret':259C,264C 'self':23B 'self-host':22B 'server':134C 'server-sid':133C 'share':239C 'side':135C 'signatur':35B,106C,255C 'sourc':84C 'suppli':193C 'target':214C 'tenant':243C 'testwebhook':110C 'theft':190C 'travers':53B,155C,250C 'trigger':8A 'unauthent':2A,207C 'unsanit':127C 'unsign':265C 'url':64B,139C 'uuid':44B,230C 'valid':107C 'valu':59B,128C 'verifi':252C 'version':90C,245C 'victim':145C 'webhook':5A,29B,96C,208C,253C,266C 'without':164C,262C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted or shared Lightdash at or before 0.3213.0 that connect a dbt Cloud IDE project through the dbt Cloud webhook. Exposure also depends on an attacker knowing the project UUID, which is not enumerable but can leak in shared or multi-tenant setups. Teams on 0.3214.0 or later, or without the dbt Cloud webhook, can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T22:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61654","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61654","severity":null,"published_at":"2026-10-29T22:17:05+00:00","modified_at":"2026-10-29T22:17:05+00:00","first_seen_at":"2026-10-29T22:27:06+00:00","fetched_at":"2026-10-29T22:27:06+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}