CVE-2026-72846

Name of the Vulnerable Software and Affected Versions Lightdash versions prior to 1.146.4

Description Lightdash fails to validate webhook URLs provided during scheduled deliveries. The sendWebhook function in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts calls fetch on the stored URL without applying the validatePublicHttpUrl helper or any server-side URL constraints. This allows a user to trigger Server-Side Request Forgery (SSRF)—a technique where an attacker forces a server to make requests to an unintended location—directing the server to issue POST requests to private, loopback, and link-local addresses, including cloud metadata endpoints. While the upstream response is not returned to the requester, users can distinguish between reachable and unreachable internal services based on the resulting errors written to the server log.

Recommendations Update to version 1.146.4.