Is CVE-2026-61576 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61576 being exploited in the wild.

How severe is CVE-2026-61576?

Informational severity, published 29 October 2026.

How is CVE-2026-61576 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-61576?

Check whether you run Lightdash at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61576: Lightdash dbt Cloud webhook SSRF and unauthenticated access

CVE-2026-61576 · Severity: info · Published 2026-10-29

Lightdash, an open-source business intelligence platform, has a dbt Cloud webhook endpoint that lacks authentication and signature validation in versions through 0.3213.0. An attacker who discovers a project's UUID can trigger unauthorized preview creation and potentially access the dbt Cloud API using the victim's credentials through path traversal manipulation.

Technologies: Lightdash. Vendors: Lightdash.

Quick answers

Is CVE-2026-61576 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61576 being exploited in the wild.
How severe is CVE-2026-61576?: Informational severity, published 29 October 2026.
Which products and versions are affected?: Lightdash through 0.3213.0.
Is there a fix for CVE-2026-61576?: Yes: fixed in 0.3214.0. Until then: Configure a webhook secret in the dbt Cloud project settings; version 0.3214.0 will validate HMAC signatures when a secret is present. Until upgrading, restrict network access to the webhook endpoint or disable dbt Cloud integration if not actively used. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61576 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-61576?: Check whether you run Lightdash at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.3214.0

Configure a webhook secret in the dbt Cloud project settings; version 0.3214.0 will validate HMAC signatures when a secret is present. Until upgrading, restrict network access to the webhook endpoint or disable dbt Cloud integration if not actively used.

Technical details

The POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook endpoint accepts unsanitized accountId and runId parameters from dbt Cloud webhook payloads and interpolates them into API requests sent to cloud.getdbt.com with the victim project's API key. Path traversal through these identifiers can redirect requests to attacker-controlled paths, and the lack of HMAC validation allows any caller to invoke the endpoint. An attacker needs knowledge of the target project's UUID (non-enumerable but discoverable in shared contexts) and must target dbt Cloud IDE projects.

Affected products

Lightdash Lightdash through 0.3213.0

Timeline

2026-10-29: disclosed
2026-06-22: patched: Fix released in version 0.3214.0 with HMAC signature verification and identifier validation

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.