CVE-2026-72846: Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery
Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored URL directly. The validatePublicHttpUrl helper in packages/backend/src/utils/ssrfProtection.ts, used for MCP server URLs, is not applied on either path, and the webhook fields carry no server-side URL constraint. A user able to create or trigger a scheduled delivery can therefore direct the server to issue POST requests to private, loopback and link-local addresses, including cloud metadata endpoints, and can distinguish reachable internal services from unreachable ones through the resulting errors. The upstream response is never returned to the requester; on a failure status its body is written to the server log instead. Version 1.146.4 routes both clients through postSchedulerWebhook from packages/backend/src/utils/schedulerWebhookValidation rather than calling fetch directly.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Lightdashto a version that resolves this vulnerability.Fixed in 1.146.4 - Configuration
For scheduled delivery webhook URLs used by GoogleChatClient.ts (packages/backend/src/clients/GoogleChat/GoogleChatClient.ts) and MicrosoftTeamsClient.ts (packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts), ensure the stored webhook URL is validated by routing requests through postSchedulerWebhook in packages/backend/src/utils/schedulerWebhookValidation, rather than calling fetch directly, so validatePublicHttpUrl (packages/backend/src/utils/ssrfProtection.ts) is enforced / equivalent server-side URL constraints are applied.
Lightdash scheduler webhook validation webhook URL validation for scheduled delivery = apply postSchedulerWebhook (packages/backend/src/utils/schedulerWebhookValidation) instead of fetch directly
Event History
Frequently Asked Questions
Who can exploit this issue?
A user who can create or trigger a scheduled delivery can supply a webhook URL that causes the Lightdash server to issue POST requests to internal, loopback, link-local, or cloud metadata addresses.
What information can an attacker obtain through the vulnerable webhook request?
The upstream response is not returned to the requester. However, the attacker can distinguish reachable internal services from unreachable ones based on resulting errors, while response bodies for failure statuses are written to the server log.
What version contains the described remediation?
Version 1.146.4 routes Google Chat and Microsoft Teams scheduled-delivery webhook requests through postSchedulerWebhook in schedulerWebhookValidation rather than calling fetch directly.