CVE-2026-61654

The business intelligence platform Lightdash (versions through 0.3213.0) contains a vulnerability in the dbt Cloud webhook endpoint (POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook). The issue stems from a lack of authentication middleware or signature validation, combined with path injecti...

CVE-2026-61576: lightdash: Lightdash is an open source business intelligence platform

Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook POST /api/v1/projects/projectUuid/dbt-cloud/webhook has no authentication middleware or signature validation. In packages/backend/src/controllers/projectController.ts,...