EUVD-2026-63731
GHSA-hw2h-qf3m-2r8v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable blind SSRF requiring low-privilege auth; scope changes to affect internal/subsequent systems; confidentiality impact limited to network probing and log leakage; no integrity or availability impact on any system.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored URL directly. The validatePublicHttpUrl helper in packages/backend/src/utils/ssrfProtection.ts, used for MCP server URLs, is not applied on either path, and the webhook fields carry no server-side URL constraint. A user able to create or trigger a scheduled delivery can therefore direct the server to issue POST requests to private, loopback and link-local addresses, including cloud metadata endpoints, and can distinguish reachable internal services from unreachable ones through the resulting errors. The upstream response is never returned to the requester; on a failure status its body is written to the server log instead. Version 1.146.4 routes both clients through postSchedulerWebhook from packages/backend/src/utils/schedulerWebhookValidation rather than calling fetch directly.
AnalysisAI
Server-Side Request Forgery in Lightdash's scheduled delivery webhook feature allows authenticated users to direct the backend server to issue POST requests to private, loopback, and link-local addresses - including cloud instance metadata endpoints. All deployments running versions prior to 1.146.4 are affected; both the Google Chat and Microsoft Teams webhook delivery paths bypass the existing validatePublicHttpUrl sanitization that is correctly applied elsewhere in the codebase. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Lightdash user account with permission to create or trigger scheduled deliveries - the CVSS PR:L metric confirms that low-privilege access is sufficient and no administrative role is needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (Medium) is consistent with the bounded exploitation model: PR:L requires an authenticated session, subsequent-system impact is rated SC:L/SI:L, and the Lightdash instance itself incurs no direct confidentiality, integrity, or availability impact (VC/VI/VA all N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Lightdash user with scheduled delivery permissions creates a delivery and sets the webhook URL to an internal address such as http://169.254.169.254/latest/meta-data/ or an internal microservice endpoint. When the delivery fires, the Lightdash backend issues an unvalidated POST to that address; by observing whether the server logs a connection failure versus an HTTP-level error, the attacker maps reachable internal services. … |
| Remediation | Upgrade Lightdash to version 1.146.4, which routes both GoogleChatClient and MicrosoftTeamsClient through the new postSchedulerWebhook function in packages/backend/src/utils/schedulerWebhookValidation, applying URL validation before any fetch call is issued; the release is available at https://github.com/lightdash/lightdash/releases/tag/1.146.4 and the fix commit is c0ba219 per GitHub issue #27313. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today