# CVE-2026-61576: Lightdash dbt Cloud webhook SSRF and unauthenticated access

Source: https://junglewise.ai/threats/cve-2026-61576-lightdash-is-an-open-source-business-intelligence-platform-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-61576 · Severity: info · Published 2026-10-29

Lightdash, an open-source business intelligence platform, has a dbt Cloud webhook endpoint that lacks authentication and signature validation in versions through 0.3213.0. An attacker who discovers a project's UUID can trigger unauthorized preview creation and potentially access the dbt Cloud API using the victim's credentials through path traversal manipulation.

Technologies: [Lightdash](https://junglewise.ai/threats/technologies/lightdash). Vendors: [Lightdash](https://junglewise.ai/threats/vendors/lightdash).

## Quick answers

**Is CVE-2026-61576 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61576 being exploited in the wild.

**How severe is CVE-2026-61576?** Informational severity, published 29 October 2026.

**Which products and versions are affected?** Lightdash through 0.3213.0.

**Is there a fix for CVE-2026-61576?** Yes: fixed in 0.3214.0. Until then: Configure a webhook secret in the dbt Cloud project settings; version 0.3214.0 will validate HMAC signatures when a secret is present. Until upgrading, restrict network access to the webhook endpoint or disable dbt Cloud integration if not actively used. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61576 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-61576?** Check whether you run Lightdash at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.3214.0

Configure a webhook secret in the dbt Cloud project settings; version 0.3214.0 will validate HMAC signatures when a secret is present. Until upgrading, restrict network access to the webhook endpoint or disable dbt Cloud integration if not actively used.

## Technical details

The POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook endpoint accepts unsanitized accountId and runId parameters from dbt Cloud webhook payloads and interpolates them into API requests sent to cloud.getdbt.com with the victim project's API key. Path traversal through these identifiers can redirect requests to attacker-controlled paths, and the lack of HMAC validation allows any caller to invoke the endpoint. An attacker needs knowledge of the target project's UUID (non-enumerable but discoverable in shared contexts) and must target dbt Cloud IDE projects.

## Affected products

- Lightdash Lightdash through 0.3213.0

## Timeline

- 2026-10-29: disclosed
- 2026-06-22: patched: Fix released in version 0.3214.0 with HMAC signature verification and identifier validation

## References

- [https://github.com/lightdash/lightdash/commit/8d1d9bb6804bbea66a7bdf1b9b00092665382f14](https://github.com/lightdash/lightdash/commit/8d1d9bb6804bbea66a7bdf1b9b00092665382f14)
- [https://github.com/lightdash/lightdash/pull/24587](https://github.com/lightdash/lightdash/pull/24587)

## Related threats

- [Lightdash authorization bypass in RenameService](https://junglewise.ai/threats/cve-2026-121631-lightdash-0-2609-0-before-3-137-0-contains-an-authorization)
- [Lightdash dbt Cloud webhook unauthenticated access and path traversal](https://junglewise.ai/threats/cve-2026-61654-lightdash-is-an-open-source-business-intelligence-platform-in)
- [Lightdash authorization bypass in personal access token deletion](https://junglewise.ai/threats/cve-2026-108747-lightdash-through-2-556-0-contains-an-authorization-bypass)
- [Lightdash SSRF in webhook delivery](https://junglewise.ai/threats/cve-2026-72846-lightdash-ssrf-in-webhook-delivery)