SSRF in Lightdash
CVE-2026-72846
Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored URL directly. The validatePublicHttpUrl helper in packages/backend/src/utils/ssrfProtection.ts, used for MCP server URLs, is not applied on either path, and the webhook fields carry no server-side URL constraint. A user able to create or trigger a scheduled delivery can therefore direct the server to issue POST requests to private, loopback and link-local addresses, including cloud metadata endpoints, and can distinguish reachable internal services from unreachable ones through the resulting errors. The upstream response is never returned to the requester; on a failure status its body is written to the server log instead. Version 1.146.4 routes both clients through postSchedulerWebhook from packages/backend/src/utils/schedulerWebhookValidation rather than calling fetch directly.
Vulnerability class: SSRF (Server-Side Request Forgery)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.003 (22.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 22nd percentile — 22.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: +0.001
Affected products
Weakness classification (CWE)
References
- github.com/lightdash/lightdash (product)
- github.com/lightdash/lightdash/blob/1.146.3/packages/backend/src/clients/Google… (technical-description)
- github.com/lightdash/lightdash/blob/1.146.3/packages/backend/src/clients/Micros… (technical-description)
- github.com/lightdash/lightdash/issues/24389 (issue-tracking)
- github.com/lightdash/lightdash/releases/tag/1.146.4 (release-notes)
- www.vulncheck.com/advisories/lightdash-scheduled-delivery-webhook-urls-are-not-… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-72846?
- CVE-2026-72846 is a medium-severity vulnerability in Lightdash, classified under Server-Side Request Forgery (SSRF). CVSS score: 6.4/10. Published 2026-08-20.
- How severe is CVE-2026-72846?
- Medium severity. CVSS v3 base score is 6.4 out of 10.