CVE-2026-72846 Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery
Attackers can exploit unvalidated webhook URLs in scheduled deliveries to perform Server-Side Request Forgery against internal services and cloud metadata endpoints.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-72846?
CVE-2026-72846 is a medium-severity server-side request forgery vulnerability in lightdash, published on 20 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored URL directly. The validatePublicHttpUrl helper in packages/backend/src/utils/ssrfProtection.ts, used for MCP server URLs, is not applied on either path, and the webhook fields carry no server-side URL constraint. A user able to create or trigger a scheduled delivery can therefore direct the server to issue POST requests to private, loopback and link-local addresses, including cloud metadata endpoints, and can distinguish reachable internal services from unreachable ones through the resulting errors. The upstream response is never returned to the requester; on a failure status its body is written to the server log instead. Version 1.146.4 routes both clients through postSchedulerWebhook from packages/backend/src/utils/schedulerWebhookValidation rather than calling fetch directly.
Weakness: CWE-918
Which versions are affected by CVE-2026-72846?
How do I fix CVE-2026-72846?
No fix has been published for CVE-2026-72846 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-72846 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-72846 exists.
Sources
Also known as GHSA-hw2h-qf3m-2r8v.