EUVD-2026-63731

Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored...

CVE-2026-72846

Lightdash (open-source BI platform) is affected by a Server-Side Request Forgery (SSRF) vulnerability in its scheduled delivery webhook handling. The sendWebhook function in both the GoogleChat and MicrosoftTeams clients calls fetch directly on user-supplied webhook URLs without applying the exis...

CVE-2026-72846 Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery

Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored...

PT-2026-79262

Name of the Vulnerable Software and Affected Versions Lightdash versions prior to 1.146.4 Description Lightdash fails to validate webhook URLs provided during scheduled deliveries. The sendWebhook function in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and...