Skip to content
Heist/ feed
Medium

Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery

Type: advisorySource: Official CVE List1 source record

Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored URL directly. The validatePublicHttpUrl helper in packages/backend/src/utils/ssrfProtection.ts, used for MCP server URLs, is not applied on either path, and the webhook fields carry no server-side URL constraint. A user able to create or trigger a scheduled delivery can therefore direct the server to issue POST requests to private, loopback and link-local addresses, including cloud metadata endpoints, and can distinguish reachable internal services from unreachable ones through the resulting errors. The upstream response is never returned to the requester; on a failure status its body is written to the server log instead. Version 1.146.4 routes both clients through postSchedulerWebhook from packages/backend/src/utils/schedulerWebhookValidation rather than calling fetch directly.

Announced Source revision 1
Original source ↗

CVE-2026-72846

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-72846

lightdash

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://github.com/lightdash/lightdash",
    "vendor": "lightdash",
    "product": "lightdash",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "1.146.4",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "1.146.4",
        "versionType": "semver"
      }
    ],
    "packageURL": "pkg:github/lightdash/lightdash",
    "programFiles": [
      "packages/backend/src/clients/GoogleChat/GoogleChatClient.ts",
      "packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts"
    ],
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2026-72846

Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event
#12995 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement