Executive brief
Lightdash is an analytics and BI tool that allows users to schedule delivery of reports via webhooks. The application fails to validate webhook URLs before posting to them, allowing an attacker with access to create scheduled deliveries to make the server send requests to internal, private, or cloud metadata endpoints. This can be used to discover and attack internal services and potentially leak sensitive cloud credentials.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) in the webhook delivery mechanism. The GoogleChatClient.ts and MicrosoftTeamsClient.ts modules store user-supplied webhook URLs and later issue POST requests via fetch() without validation. The validatePublicHttpUrl helper that is used elsewhere in the codebase to prevent SSRF is not applied to webhook URLs, which carry no server-side constraint. An authenticated user able to create or trigger a scheduled delivery can craft a webhook URL pointing to private IP ranges, loopback addresses, link-local addresses, or cloud metadata endpoints. While response bodies are not directly returned to the attacker, error messages are logged server-side, allowing the attacker to enumerate reachable internal services. The vulnerability is fixed in version 1.146.4, which routes webhook requests through postSchedulerWebhook with proper validation.
Affected products
- Lightdash Lightdash before 1.146.4
Timeline
- 2026-08-20: disclosed