Is CVE-2026-61654 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61654 being exploited in the wild.

How severe is CVE-2026-61654?

Informational severity, published 29 October 2026.

How is CVE-2026-61654 attacked?

It is attacked over the network.

Am I affected by CVE-2026-61654?

Check whether you run Lightdash at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61654: Lightdash dbt Cloud webhook unauthenticated access and path traversal

CVE-2026-61654 · Severity: info · Published 2026-10-29

Lightdash is an open-source business intelligence platform that integrates with dbt Cloud. In affected versions through 0.3213.0, an unauthenticated attacker who knows a project's UUID can trigger preview creation and send requests to dbt Cloud's API using the victim's credentials, potentially accessing internal API paths. The vulnerability requires knowledge of the specific project identifier and targeting a dbt Cloud IDE project, but allows an attacker without legitimate access to manipulate data processing and preview generation.

Technologies: Lightdash. Vendors: Lightdash.

Quick answers

Is CVE-2026-61654 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61654 being exploited in the wild.
How severe is CVE-2026-61654?: Informational severity, published 29 October 2026.
Which products and versions are affected?: Lightdash through 0.3213.0.
Is there a fix for CVE-2026-61654?: Yes: fixed in 0.3214.0. Until then: Configure a webhook secret on dbt Cloud projects; version 0.3214.0 enforces HMAC signature verification when a secret is present. Restrict visibility of project UUIDs in shared or multi-tenant environments to limit discovery of targets. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61654 attacked?: It is attacked over the network.
Am I affected by CVE-2026-61654?: Check whether you run Lightdash at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.3214.0

Configure a webhook secret on dbt Cloud projects; version 0.3214.0 enforces HMAC signature verification when a secret is present. Restrict visibility of project UUIDs in shared or multi-tenant environments to limit discovery of targets.

Technical details

The dbt Cloud webhook endpoint POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook lacks authentication middleware and signature validation in versions through 0.3213.0. The endpoint accepts unsanitized accountId and runId parameters from webhook payloads and interpolates them into server-side dbt Cloud API URLs without validation, enabling path traversal. These requests are made using the victim project's dbt Cloud API key. Version 0.3214.0 adds integer validation for identifiers and optional HMAC signature verification, though verification is only enforced when a webhook secret is configured.

Affected products

Lightdash Lightdash through 0.3213.0

Timeline

2026-10-29: disclosed
2026-06-22: patched: Fix commit merged; version 0.3214.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.