Lightdash creates scheduled deliveries that POST to a user‑supplied webhook URL. In affected releases, the POST request is performed directly with no validation of the URL, allowing a user who can create or trigger a delivery to supply any private, loopback, or link‑local address. The server will then send the POST request, but it never returns the upstream response to the requester; instead, any error payload is recorded in the server log. This behavior enables an attacker to probe internal network services and potentially interact with protected endpoints such as cloud metadata services, with the ability to distinguish reachable hosts from unreachable ones by the resulting error messages. While the flaw does not directly execute code, it can be leveraged for internal reconnaissance and, if the internal endpoint is vulnerable, for further compromise.

The vulnerability applies to the open‑source Lightdash product in the version series 1.146.3. It was discovered in the code that handles Google Chat and Microsoft Teams webhook clients. The fix is included in release 1.146.4, which redirects the webhook calls through a validation routine that restricts URLs to public endpoints.

The CVSS score is 5.3, reflecting moderate severity. EPSS data is unavailable, and the issue is not listed in the CISA KEV catalog. Attackers require permissions to create or trigger a scheduled delivery, so the threat is limited to users with those rights. The attacker can target any internal IP range reachable from the server, including private and link‑local addresses. The exploit does not provide direct code execution but can facilitate internal scanning or interaction with sensitive services, making it a non‑zero‑day risk for systems exposed to privileged users.