Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook "POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook" has no authentication middleware or signature validation. In "packages/backend/src/controllers/projectController.ts", "testWebhook()" accepts "accountId" and "runId" from a "job.run.completed" request and passes them to "createPreviewWithExplores()" in "packages/backend/src/services/ProjectService/ProjectService.ts". These unsanitized values are interpolated into the server-side dbt Cloud API URL, which is requested with the victim project's API key in the "Authorization" header. Path traversal through "accountId" changes the requested path on "cloud.getdbt.com" without changing its host, so the credential-bearing request reaches an attacker-influenced path on that fixed host. The advisory claims API-key theft, but the supplied evidence does not establish that the attacker can observe the "Authorization" header. The unauthenticated webhook also allows preview creation. The target must be a "dbt Cloud IDE" project and the attacker must know its "projectUuid"; the UUID is not enumerable but can be discovered in shared or multi-tenant contexts. Version 0.3214.0 fixes identifier path traversal and verifies webhook HMAC signatures only when a secret is configured; without a secret, unsigned webhooks continue to be processed.