CVE-2026-61576

Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook `POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook` has no authentication middleware or signature validation. In `packages/backend/src/controllers/projectController.ts`, `testWebhook()` accepts `accountId` and `runId` from a `job.run.completed` request and passes them to `createPreviewWithExplores()` in `packages/backend/src/services/ProjectService/ProjectService.ts`. These unsanitized values are interpolated into the server-side dbt Cloud API URL, which is requested with the victim project's API key in the `Authorization` header. Path traversal through `accountId` changes the requested path on `cloud.getdbt.com` without changing its host, so the credential-bearing request reaches an attacker-influenced path on that fixed host. The advisory claims API-key theft, but the supplied evidence does not establish that the attacker can observe the `Authorization` header. The unauthenticated webhook also allows preview creation. The target must be a `dbt Cloud IDE` project and the attacker must know its `projectUuid`; the UUID is not enumerable but can be discovered in shared or multi-tenant contexts. Version 0.3214.0 fixes identifier path traversal and verifies webhook HMAC signatures only when a secret is configured; without a secret, unsigned webhooks continue to be processed.

• CWE-22

• https://github.com/lightdash/lightdash/commit/8d1d9bb6804bbea66a7bdf1b9b00092665382f14
• https://github.com/lightdash/lightdash/pull/24587
• https://github.com/lightdash/lightdash/releases/tag/0.3214.0
• https://github.com/lightdash/lightdash/security/advisories/GHSA-3594-hhm2-76fj

Published

Oct 29, 2026

Last Modified

Oct 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61570MPXJ is an open source library to read and write project pla…7.5
• CVE-2026-61571AVideo is a video-sharing Platform. Prior to 8.1.0, the enco…7.3
• CVE-2026-61572AVideo is a video-sharing Platform. Before the initial remed…8.6
• CVE-2026-61573AVideo is a video-sharing Platform. Prior to 8.1.0, the anon…6.1
• CVE-2026-61574authentik is an open-source identity provider. Prior to 2026…8.8
• CVE-2026-61575AVideo is a video-sharing Platform. Prior to 8.1.0, `view/qu…4.7
• CVE-2026-6158A flaw has been found in Totolink N300RH 6.1c.1353_B20190305…7.3
• CVE-2026-61586Copernik XML Factory provides secure-by-default JAXP factory…8.2
• CVE-2026-61588djust provides Phoenix LiveView-style reactive server-side r…6.5
• CVE-2026-61589djust provides Phoenix LiveView-style reactive server-side r…6.3
• CVE-2026-6159A vulnerability has been found in code-projects Simple ChatB…4.3
• CVE-2026-61590djust provides Phoenix LiveView-style reactive server-side r…7.4