Description
Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook `POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook` has no authentication middleware or signature validation. In `packages/backend/src/controllers/projectController.ts`, `testWebhook()` accepts `accountId` and `runId` from a `job.run.completed` request and passes them to `createPreviewWithExplores()` in `packages/backend/src/services/ProjectService/ProjectService.ts`. These unsanitized values are interpolated into the server-side dbt Cloud API URL, which is requested with the victim project's API key in the `Authorization` header. Path traversal through `accountId` changes the requested path on `cloud.getdbt.com` without changing its host, so the credential-bearing request reaches an attacker-influenced path on that fixed host. The advisory claims API-key theft, but the supplied evidence does not establish that the attacker can observe the `Authorization` header. The unauthenticated webhook also allows preview creation. The target must be a `dbt Cloud IDE` project and the attacker must know its `projectUuid`; the UUID is not enumerable but can be discovered in shared or multi-tenant contexts. Version 0.3214.0 fixes identifier path traversal and verifies webhook HMAC signatures only when a secret is configured; without a secret, unsigned webhooks continue to be processed.
Published: 2026-10-29
Score: 8.3 High
EPSS: n/a
KEV: No
Impact: Unauthorized API key disclosure
Action: Patch immediately
AI Analysis

Impact

The flaw allows an unauthenticated POST to the dbt Cloud webhook endpoint, where unvalidated accountId and runId values are embedded directly into a dbt Cloud API request. This path traversal can modify the request path on cloud.getdbt.com while maintaining the victim project’s API key in the Authorization header, potentially exposing that key or enabling unauthorized use of the API.

Affected Systems

Lightdash instances running any version up to and including 0.3213.0 are affected. The vulnerability manifests in the POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook route and requires knowledge of the target project’s UUID. Version 0.3214.0 and later contain the fix, which sanitizes identifiers and enforces webhook HMAC signatures when a secret is configured.

Risk and Exploitability

The CVSS score of 8.3 indicates a high severity. The EPSS score is unavailable, and the issue is not listed in CISA’s KEV catalog. Attackers can exploit the unauthenticated endpoint if they can determine a project UUID, and they may trigger path traversal to reach malicious paths on the dbt Cloud host. Although the advisory does not confirm that the attacker can directly read the Authorization header, the potential for key leakage or unintended API calls raises significant concern for confidentiality and integrity.

Generated by OpenCVE AI on October 29, 2026 at 22:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Lightdash to version 0.3214.0 or newer to eliminate the path traversal and apply signature verification when a webhook secret is configured
  • If an upgrade is not immediately possible, configure a webhook secret in the Lightdash settings so that only signed webhook requests are processed, effectively blocking unsigned traffic
  • Restrict network access to the /api/v1/projects/*/dbt-cloud/webhook endpoint using firewall rules or reverse‑proxy authentication to limit exposure to trusted hosts
  • Regularly monitor audit logs for unauthorized POST requests to the webhook endpoint and investigate any anomalies promptly

Generated by OpenCVE AI on October 29, 2026 at 22:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook `POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook` has no authentication middleware or signature validation. In `packages/backend/src/controllers/projectController.ts`, `testWebhook()` accepts `accountId` and `runId` from a `job.run.completed` request and passes them to `createPreviewWithExplores()` in `packages/backend/src/services/ProjectService/ProjectService.ts`. These unsanitized values are interpolated into the server-side dbt Cloud API URL, which is requested with the victim project's API key in the `Authorization` header. Path traversal through `accountId` changes the requested path on `cloud.getdbt.com` without changing its host, so the credential-bearing request reaches an attacker-influenced path on that fixed host. The advisory claims API-key theft, but the supplied evidence does not establish that the attacker can observe the `Authorization` header. The unauthenticated webhook also allows preview creation. The target must be a `dbt Cloud IDE` project and the attacker must know its `projectUuid`; the UUID is not enumerable but can be discovered in shared or multi-tenant contexts. Version 0.3214.0 fixes identifier path traversal and verifies webhook HMAC signatures only when a secret is configured; without a secret, unsigned webhooks continue to be processed.
Title Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key
Weaknesses CWE-89
References
Metrics cvssV4_0

{'score': 8.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-29T21:19:12.542Z

Reserved: 2026-07-10T18:25:21.466Z

Link: CVE-2026-61654

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-29T22:17:05.110

Modified: 2026-10-29T22:17:05.227

Link: CVE-2026-61654

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T22:30:13Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')