CVE-2026-72846 lightdash CVE debrief

Who should care

Lightdash users, administrators, and security teams should be aware of this SSRF vulnerability and take steps to protect their instances. They should review and apply the patch in version 1.146.4, restrict webhook URLs to trusted external services, monitor server logs for suspicious POST requests, and implement additional SSRF protections. Inventory and assess exposure of internal services to prevent potential SSRF attacks. This issue requires immediate attention to prevent potential security breaches. Security teams should prioritize patching to prevent potential SSRF attacks and review compensating controls for exposed systems while remediation is scheduled and verified. They should also check relevant monitoring, detection, and logs for exposed assets that need extra review and track exceptions, retest remediated assets, and close the item only after evidence is documented. Affected operator, platform, vulnerability-management, and security-team impact should be carefully evaluated to ensure proper mitigation. This vulnerability can have a significant impact on the security posture of affected systems, and prompt action is necessary to mitigate the risk. The CVE record was published on 2026-08-20T22:18:05.400Z and has not been modified since then, emphasizing the need for immediate attention. Lightdash users and administrators must take proactive measures to protect their instances from potential SSRF attacks. By prioritizing patching and implementing additional security measures, organizations can minimize the risk associated with this vulnerability. Security teams should also consider the potential operational impact of this vulnerability and develop strategies to mitigate it. Overall, a comprehensive approach is necessary to address this security issue effectively. The debrief provides an overview of the vulnerability, its impact, and recommended actions to mitigate the risk. It is essential to review and apply the patch in version 1.146.4 as soon as possible to prevent potential security breaches. Additionally, organizations should consider implementing compensating controls, monitoring server logs, and inventorying and assessing exposure of internal to

Technical summary

Lightdash stores webhook URLs for scheduled deliveries and posts to them without proper validation, allowing SSRF attacks. A user can direct the server to issue POST requests to private, loopback, and link-local addresses, including cloud metadata endpoints. The validatePublicHttpUrl helper, used for MCP server URLs, is not applied to these paths, and webhook fields have no server-side URL constraint. This allows distinguishing reachable internal services from unreachable ones through resulting errors. The upstream response is never returned to the requester; on a failure status, its body is written to the server log instead. Version 1.146.4 mitigates this by routing both clients through postSchedulerWebhook.

Defensive priority

Organizations using Lightdash should prioritize patching to prevent potential SSRF attacks.

Recommended defensive actions

• Review and apply the patch in version 1.146.4
• Restrict webhook URLs to trusted external services
• Monitor server logs for suspicious POST requests
• Implement additional SSRF protections
• Inventory and assess exposure of internal services

Evidence notes

The CVE-2026-72846 issue arises from Lightdash's handling of webhook URLs in scheduled deliveries. A user can create or trigger a scheduled delivery to direct the server to issue POST requests to private, loopback, and link-local addresses, including cloud metadata endpoints. The validatePublicHttpUrl helper, used for MCP server URLs, is not applied to these paths, and webhook fields have no server-side URL constraint. This allows distinguishing reachable internal services from unreachable ones through resulting errors. The upstream response is never returned to the requester; on a failure status, its body is written to the server log instead. Version 1.146.4 mitigates this by routing both clients through postSchedulerWebhook.

Official resources