{"apiVersion":"1.0","identifier":"CVE-2026-72846","description":"Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored URL directly. The validatePublicHttpUrl helper in packages/backend/src/utils/ssrfProtection.ts, used for MCP server URLs, is not applied on either path, and the webhook fields carry no server-side URL constraint. A user able to create or trigger a scheduled delivery can therefore direct the server to issue POST requests to private, loopback and link-local addresses, including cloud metadata endpoints, and can distinguish reachable internal services from unreachable ones through the resulting errors. The upstream response is never returned to the requester; on a failure status its body is written to the server log instead. Version 1.146.4 routes both clients through postSchedulerWebhook from packages/backend/src/utils/schedulerWebhookValidation rather than calling fetch directly.","publishedAt":"2026-08-20T22:18:05","lastModifiedAt":"2026-08-21T16:18:16","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72846","cvssScore":6.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","epssProbability":0.00263,"riskScore":0.66,"affectedProduct":"Lightdash","affectedVersions":"<1.146.4","vulnerabilityType":"Web app","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72846","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72846","en":"https://www.redsauce.net/en/cves/CVE-2026-72846","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72846","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72846","de":"https://www.redsauce.net/de/cves/CVE-2026-72846","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72846","el":"https://www.redsauce.net/el/cves/CVE-2026-72846"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72846"}}