{"schema_version":1,"title":"Lightdash vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 6 vulnerabilities in Lightdash: 0 in the last 7 days and 5 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-121631, was published on 3 November 2026. 3 vulnerabilities in the last four weeks, up 200% on the four before (1). 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/lightdash","json_url":"https://junglewise.ai/threats/vendors/lightdash.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/lightdash","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","thin":false,"counts":{"high":0,"all_time":6,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":3,"last_90_days":5,"last_365_days":6},"latest":[{"cve":"CVE-2026-121631","cvss":4.2,"slug":"cve-2026-121631-lightdash-0-2609-0-before-3-137-0-contains-an-authorization","title":"Lightdash authorization bypass in RenameService","severity":"medium","exploited":false,"published_at":"2026-11-03T17:18:11.913+00:00","url":"https://junglewise.ai/threats/cve-2026-121631-lightdash-0-2609-0-before-3-137-0-contains-an-authorization"},{"cve":"CVE-2026-61654","slug":"cve-2026-61654-lightdash-is-an-open-source-business-intelligence-platform-in","title":"Lightdash dbt Cloud webhook unauthenticated access and path traversal","severity":"info","exploited":false,"published_at":"2026-10-29T22:17:05.11+00:00","url":"https://junglewise.ai/threats/cve-2026-61654-lightdash-is-an-open-source-business-intelligence-platform-in"},{"cve":"CVE-2026-61576","slug":"cve-2026-61576-lightdash-is-an-open-source-business-intelligence-platform-in","title":"Lightdash dbt Cloud webhook SSRF and unauthenticated access","severity":"info","exploited":false,"published_at":"2026-10-29T21:17:27.313+00:00","url":"https://junglewise.ai/threats/cve-2026-61576-lightdash-is-an-open-source-business-intelligence-platform-in"},{"cve":"CVE-2026-108747","cvss":4.2,"epss":0.0021,"slug":"cve-2026-108747-lightdash-through-2-556-0-contains-an-authorization-bypass","title":"Lightdash authorization bypass in personal access token deletion","severity":"medium","exploited":false,"published_at":"2026-10-11T13:17:19.367+00:00","url":"https://junglewise.ai/threats/cve-2026-108747-lightdash-through-2-556-0-contains-an-authorization-bypass"},{"cve":"CVE-2026-72846","cvss":6.4,"epss":0.0035,"slug":"cve-2026-72846-lightdash-ssrf-in-webhook-delivery","title":"Lightdash SSRF in webhook delivery","severity":"medium","exploited":false,"published_at":"2026-08-20T22:18:05.4+00:00","url":"https://junglewise.ai/threats/cve-2026-72846-lightdash-ssrf-in-webhook-delivery"},{"cvss":3.1,"slug":"lightdash-lightdash-cli-supply-chain-attack-via-compromised-axios-05be2e70","title":"Lightdash CLI supply chain compromise via axios malware","severity":"low","exploited":false,"published_at":"2026-04-02T18:36:10+00:00","url":"https://junglewise.ai/threats/lightdash-lightdash-cli-supply-chain-attack-via-compromised-axios-05be2e70"}],"vendor":{"hub":true,"name":"Lightdash","slug":"lightdash","url":"https://junglewise.ai/threats/vendors/lightdash"},"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-72846","cvss":6.4,"epss":0.0035,"slug":"cve-2026-72846-lightdash-ssrf-in-webhook-delivery","title":"Lightdash SSRF in webhook delivery","severity":"medium","exploited":false,"published_at":"2026-08-20T22:18:05.4+00:00","url":"https://junglewise.ai/threats/cve-2026-72846-lightdash-ssrf-in-webhook-delivery"},{"cve":"CVE-2026-108747","cvss":4.2,"epss":0.0021,"slug":"cve-2026-108747-lightdash-through-2-556-0-contains-an-authorization-bypass","title":"Lightdash authorization bypass in personal access token deletion","severity":"medium","exploited":false,"published_at":"2026-10-11T13:17:19.367+00:00","url":"https://junglewise.ai/threats/cve-2026-108747-lightdash-through-2-556-0-contains-an-authorization-bypass"},{"cve":"CVE-2026-121631","cvss":4.2,"slug":"cve-2026-121631-lightdash-0-2609-0-before-3-137-0-contains-an-authorization","title":"Lightdash authorization bypass in RenameService","severity":"medium","exploited":false,"published_at":"2026-11-03T17:18:11.913+00:00","url":"https://junglewise.ai/threats/cve-2026-121631-lightdash-0-2609-0-before-3-137-0-contains-an-authorization"},{"cvss":3.1,"slug":"lightdash-lightdash-cli-supply-chain-attack-via-compromised-axios-05be2e70","title":"Lightdash CLI supply chain compromise via axios malware","severity":"low","exploited":false,"published_at":"2026-04-02T18:36:10+00:00","url":"https://junglewise.ai/threats/lightdash-lightdash-cli-supply-chain-attack-via-compromised-axios-05be2e70"},{"cve":"CVE-2026-61654","slug":"cve-2026-61654-lightdash-is-an-open-source-business-intelligence-platform-in","title":"Lightdash dbt Cloud webhook unauthenticated access and path traversal","severity":"info","exploited":false,"published_at":"2026-10-29T22:17:05.11+00:00","url":"https://junglewise.ai/threats/cve-2026-61654-lightdash-is-an-open-source-business-intelligence-platform-in"},{"cve":"CVE-2026-61576","slug":"cve-2026-61576-lightdash-is-an-open-source-business-intelligence-platform-in","title":"Lightdash dbt Cloud webhook SSRF and unauthenticated access","severity":"info","exploited":false,"published_at":"2026-10-29T21:17:27.313+00:00","url":"https://junglewise.ai/threats/cve-2026-61576-lightdash-is-an-open-source-business-intelligence-platform-in"}],"generated_at":"2026-11-11T03:07:00.183524+00:00","technologies":[{"name":"Lightdash","slug":"lightdash","vulnerabilities":5,"url":"https://junglewise.ai/threats/technologies/lightdash"}]}