Dbt-labs vulnerabilities

Products

• Dbt-core 4
• Dbt-mcp 4

Newest

• dbt-labs dbt-core dbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve` CVE-2026-100406 8.2 HighOctober 14, 2026
• dbt-labs dbt-mcp dbt-mcp: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens CVE-2026-55837 Fix available 6.8 MediumJune 19, 2026
• dbt-labs dbt-mcp, getdbt dbt mcp server +1 more dbt-mcp: All MCP Tool Arguments Including Raw SQL and --vars Credentials Transmitted to dbt Labs Telemetry by Default Without Redaction CVE-2026-44970 Fix available 3.1 LowMay 14, 2026
• dbt-labs dbt-mcp, getdbt dbt mcp server +1 more dbt-mcp: Tool Arguments Including SQL Queries and Credentials Logged in Plaintext Without Redaction When File Logging Is Enabled CVE-2026-44969 Fix available 2.5 LowMay 14, 2026
• dbt-labs dbt-mcp, getdbt dbt mcp server +1 more dbt-mcp: Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters CVE-2026-44968 Fix available 6.3 MediumMay 14, 2026
• dbt-labs dbt-core dbt has a Command Injection in Reusable Workflow via Unsanitized comment-body Output CVE-2026-39382 Public exploit 9.3 CriticalApril 7, 2026
• dbt-labs dbt-common dbt-common: commonprefix() doesn't protect against path traversal CVE-2026-29790 Fix available 2.0 LowMarch 5, 2026
• dbt-labs dbt-core Implicit override for built-in materializations from installed packages in dbt-core CVE-2024-40637 Fix available 4.2 MediumJuly 16, 2024
• dbt-labs dbt-core dbt allows Binding to an Unrestricted IP Address via socketsocket CVE-2024-36105 Fix available 5.3 MediumMay 27, 2024