CVE-2026-61654
Deferred Deferred - Pending Action

Path Traversal in Lightdash BI Platform

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: GitHub, Inc.

Description
Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook `POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook` has no authentication middleware or signature validation. In `packages/backend/src/controllers/projectController.ts`, `testWebhook()` accepts `accountId` and `runId` from a `job.run.completed` request and passes them to `createPreviewWithExplores()` in `packages/backend/src/services/ProjectService/ProjectService.ts`. These unsanitized values are interpolated into the server-side dbt Cloud API URL, which is requested with the victim project's API key in the `Authorization` header. Path traversal through `accountId` changes the requested path on `cloud.getdbt.com` without changing its host, so the credential-bearing request reaches an attacker-influenced path on that fixed host. The advisory claims API-key theft, but the supplied evidence does not establish that the attacker can observe the `Authorization` header. The unauthenticated webhook also allows preview creation. The target must be a `dbt Cloud IDE` project and the attacker must know its `projectUuid`; the UUID is not enumerable but can be discovered in shared or multi-tenant contexts. Version 0.3214.0 fixes identifier path traversal and verifies webhook HMAC signatures only when a secret is configured; without a secret, unsigned webhooks continue to be processed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-29
Last Modified
2026-10-29
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-61654
EUVD
EUVD-2026-113396

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
lightdash lightdash < 0.3214.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Lightdash, an open-source business intelligence platform. It involves a dbt Cloud webhook endpoint that lacks authentication or signature validation. Attackers can manipulate the accountId parameter to perform path traversal, potentially accessing unauthorized paths on cloud.getdbt.com using the victim's API key. The vulnerability also allows unauthenticated preview creation.

Detection Guidance

Detecting this vulnerability requires checking for unauthenticated Lightdash webhook endpoints and path traversal in dbt Cloud API requests. Inspect network traffic for POST requests to /api/v1/projects/{projectUuid}/dbt-cloud/webhook without authentication headers. Verify if accountId or runId parameters contain path traversal sequences like ../. Also check Lightdash logs for unauthorized preview creation requests.

Impact Analysis

If you use Lightdash versions through 0.3213.0, an attacker could exploit this to steal your API key or create unauthorized previews. The attacker needs your projectUuid, which may be discoverable in shared environments. The impact includes potential data breaches or unauthorized actions using your credentials.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. It may result in data breaches, unauthorized processing, or disclosure of personal health information, potentially leading to regulatory penalties.

Mitigation Strategies

Upgrade Lightdash to version 0.3214.0 or later to fix path traversal and enforce HMAC signature validation. If using webhooks, configure a secret key to enable HMAC verification. Disable unauthenticated webhook processing if a secret cannot be configured. Audit all API keys and rotate them if they may have been exposed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61654. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart