{"id":"CVE-2026-72846","revision":"4a174710a315452aa39ecc79ceaac2af","records":[{"revision":"4a174710a315452aa39ecc79ceaac2af","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-72846","aliases":[],"title":"Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery","description":"Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored URL directly. The validatePublicHttpUrl helper in packages/backend/src/utils/ssrfProtection.ts, used for MCP server URLs, is not applied on either path, and the webhook fields carry no server-side URL constraint. A user able to create or trigger a scheduled delivery can therefore direct the server to issue POST requests to private, loopback and link-local addresses, including cloud metadata endpoints, and can distinguish reachable internal services from unreachable ones through the resulting errors. The upstream response is never returned to the requester; on a failure status its body is written to the server log instead. Version 1.146.4 routes both clients through postSchedulerWebhook from packages/backend/src/utils/schedulerWebhookValidation rather than calling fetch directly.","state":0,"publishedAt":"2026-08-20T21:57:35.568+00:00","modifiedAt":"2026-10-08T15:51:41.465+00:00","affected":[{"ecosystem":"Vendor product","name":"lightdash","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"lightdash\",\n                    \"product\": \"lightdash\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:github/lightdash/lightdash\",\n                    \"repo\": \"https://github.com/lightdash/lightdash\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"1.146.4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"1.146.4\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"programFiles\": [\n                        \"packages/backend/src/clients/GoogleChat/GoogleChatClient.ts\",\n                        \"packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts\"\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","score":6.4,"severity":"MEDIUM"},{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/lightdash/lightdash/issues/24389","https://github.com/lightdash/lightdash/blob/1.146.3/packages/backend/src/clients/GoogleChat/GoogleChatClient.ts","https://github.com/lightdash/lightdash/blob/1.146.3/packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts","https://github.com/lightdash/lightdash/releases/tag/1.146.4","https://github.com/lightdash/lightdash","https://www.vulncheck.com/advisories/lightdash-scheduled-delivery-webhook-urls-are-not-validated-allowing-server-side-request-forgery"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72846","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-72846","identifiers":["CVE-2026-72846"]},"retained":false,"historicalAffected":[]}],"coverage":[]}