Lightdash CVE-2026-61654

Requires that the Lightdash project be configured as a 'dbt Cloud IDE' project and that the attacker know its projectUuid, which is not enumerable but can be obtained in shared or multi-tenant contexts. No authentication is required (PR:N): in affected versions through 0.3213.0 the dbt Cloud webhook endpoint has no auth middleware and no signature validation, so a crafted job.run.completed POST is accepted outright. Limiting factors: knowledge of the non-enumerable UUID, the dbt-Cloud-IDE project-type requirement, and that even after 0.3214.0 HMAC signatures are verified ONLY when a webhook secret is configured - without a secret, unsigned webhooks continue to be processed.

Signals are mixed and point to a real but conditional issue rather than a mass-exploitation emergency. The CVSS 4.0 base score of 8.3 (AV:N/AC:L/AT:P/PR:N/UI:N) reflects an unauthenticated, network-reachable webhook (POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook) with no auth middleware or signature validation, which is genuinely attractive. However, AT:P and the description both encode a real limiter: the target must be a 'dbt Cloud IDE' project and the attacker must know the project's projectUuid, which is not enumerable (only discoverable in shared/multi-tenant contexts). The vuln.today decision label is 'this_week', not act_now/emergency. No CISA KEV entry and no EPSS score are provided, so there is no evidence of active exploitation or a quantified exploitation probability. A detailed public PoC reference exists in the attached advisory, but it describes a SQL-injection vector (see confidence_notes), not the webhook path-traversal flaw this CVE text and the PR fix actually address; it is not verified as working exploit code for this flaw. CONFLICT: the input CVSS 4.0 assigns VC:H (high confidentiality impact tied to API-key theft), yet the description explicitly states the supplied evidence does NOT establish that the attacker can observe the Authorization header - so the headline confidentiality impact is unproven and may be overstated. Net: a legitimate 'patch this week' issue, most dangerous in shared/multi-tenant Lightdash deployments, but not a confirmed-exploited, internet-wide crisis.

In a shared or multi-tenant Lightdash deployment, an attacker who has learned a dbt Cloud IDE project's projectUuid sends an unauthenticated job.run.completed webhook whose accountId contains path-traversal sequences. Lightdash interpolates the unsanitized value into the server-side dbt Cloud API URL and issues the request with the victim project's API key in the Authorization header to an attacker-influenced path on the fixed host cloud.getdbt.com, and can also trigger unauthorized preview creation. A public PoC reference exists in the advisory, though it demonstrates a separate SQL-injection vector rather than this webhook flaw.