dbt-labs vulnerabilities

Products

• dbt-core 4
• dbt-mcp 4
• dbt-common 1

Latest dbt-labs CVEs

Newest publication first

1. CVE-2026-100406 dbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve`

   Published 2026-10-14

   High·CVSS 8.2 EPSS 0.42%

   dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src...

2. CVE-2026-55837 dbt-mcp: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens

   Published 2026-09-14

   Medium·CVSS 6.8 EPSS 0.27%

   dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.20.0, the local OAuth helper in src/dbt_mcp/oauth/fastapi_app.py exposes GET /dbt_platform_context without authentication or Host validation after a user completes the dbt Platform OAuth flow. The end...

3. CVE-2026-44969 dbt-mcp: Tool Arguments Including SQL Queries and Credentials Logged in Plaintext Without Redaction When File Logging Is Enabled

   Published 2026-07-16

   Low·CVSS 3.3 EPSS 0.17%

   dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DbtMCP.call_tool() in src/dbt_mcp/mcp/server.py logged the raw arguments dictionary at INFO level before each tool call and at ERROR level on exceptions, and configure_file_logging() wrote those...

4. CVE-2026-44970 dbt-mcp: All MCP Tool Arguments Including Raw SQL and --vars Credentials Transmitted to dbt Labs Telemetry by Default Without Redaction

   Published 2026-07-16

   Medium·CVSS 4.3 EPSS 0.37%

   dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DefaultUsageTracker.emit_tool_called_event() in src/dbt_mcp/tracking/tracking.py serialized every MCP tool call's complete arguments dictionary and sent it through dbtlabs_vortex.producer.log_pr...

5. CVE-2026-44968 dbt-mcp: Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters

   Published 2026-07-16

   Medium·CVSS 6.3 EPSS 0.21%

   dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, _run_dbt_command() in src/dbt_mcp/dbt_cli/tools.py appended unsanitized node_selection and resource_type values to the dbt subprocess argument list, allowing an MCP client to inject dbt global f...

6. CVE-2026-39382 dbt has a Command Injection in Reusable Workflow via Unsanitized comment-body Output

   Published 2026-04-07

   Critical·CVSS 9.3 EPSS 0.40%

   dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Inside the reusable workflow dbt-labs/actions/blob/main/.github/workflows/open-issue-in-repo.yml, the prep job uses peter-evans/find-comment...

7. CVE-2026-29790 dbt-common: commonprefix() doesn't protect against path traversal

   Published 2026-03-06

   Low·CVSS 2.0 EPSS 0.31%

   dbt-common is the shared common utilities for dbt-core and adapter implementations use. Prior to versions 1.34.2 and 1.37.3, a path traversal vulnerability exists in dbt-common's safe_extract() function used when extracting tarball archives. The function uses os.path.commonprefix...

8. CVE-2024-40637 Implicit override for built-in materializations from installed packages in dbt-core

   Published 2024-07-16

   High·CVSS 7.3 EPSS 0.37%

   dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user installs a package in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by...

9. CVE-2024-36105 dbt allows Binding to an Unrestricted IP Address via socketsocket

   Published 2024-05-27

   Medium·CVSS 5.3 EPSS 0.71%

   dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Prior to versions 1.6.15, 1.7.15, and 1.8.1, Binding to INADDR_ANY (0.0.0.0) or IN6ADDR_ANY (::) exposes an application on all network inter...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.