CVE-2026-72846

Received Received - Intake

Stored SSRF via Unvalidated Webhook URLs in Lightdash

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: VulnCheck

Description

Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored URL directly. The validatePublicHttpUrl helper in packages/backend/src/utils/ssrfProtection.ts, used for MCP server URLs, is not applied on either path, and the webhook fields carry no server-side URL constraint. A user able to create or trigger a scheduled delivery can therefore direct the server to issue POST requests to private, loopback and link-local addresses, including cloud metadata endpoints, and can distinguish reachable internal services from unreachable ones through the resulting errors. The upstream response is never returned to the requester; on a failure status its body is written to the server log instead. Version 1.146.4 routes both clients through postSchedulerWebhook from packages/backend/src/utils/schedulerWebhookValidation rather than calling fetch directly.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-72846

EUVD

EUVD-2026-63731

Affected Vendors & Products

Vendor	Product	Version / Range
lightdash	lightdash	1.146.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

Lightdash allows users to create scheduled deliveries with webhook URLs. In older versions, the application directly calls fetch on these URLs without validating if they are public or internal. This can let attackers send POST requests to private or internal addresses, including cloud metadata endpoints, and detect reachable services through error responses.

Detection Guidance

To detect this vulnerability, monitor outbound POST requests from your Lightdash server to unexpected internal or external addresses. Check server logs for failed webhook attempts to private, loopback, or link-local addresses. Verify if the server is using vulnerable versions before 1.146.4 by inspecting the code paths in GoogleChatClient.ts and MicrosoftTeamsClient.ts.

Impact Analysis

An attacker could exploit this to probe internal networks, access sensitive cloud metadata, or interact with unreachable services. While the server logs errors, the attacker can infer internal service availability, potentially leading to further attacks or data exposure.

Compliance Impact

This vulnerability could violate compliance by allowing unauthorized network probing or data exfiltration, potentially breaching confidentiality requirements in GDPR or HIPAA. Uncontrolled internal access may also lead to data leaks or unauthorized modifications.

Mitigation Strategies

Upgrade to version 1.146.4 or later where webhook calls are routed through postSchedulerWebhook for validation. Ensure the validatePublicHttpUrl helper is applied to all webhook URLs in GoogleChatClient.ts and MicrosoftTeamsClient.ts.

Hi! I’m here to help you understand CVE-2026-72846. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70