Skip to content
OpenAdvisories

Package · PyPI

dbt-mcp

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.8
    CVE-2026-55837

    dbt-mcp: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens

    dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.20.0, the local OAuth helper in src/dbt_mcp/oauth/fastapi_app.py exposes GET /dbt_platform_context without authentication or Host validation after a user completes the dbt Platfor…

    dbt-labs dbt-mcp dbt-mcp PyPI
  • Medium 6.3
    CVE-2026-44968

    dbt-mcp: Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters

    dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, _run_dbt_command() in src/dbt_mcp/dbt_cli/tools.py appended unsanitized node_selection and resource_type values to the dbt subprocess argument list, allowing an MCP client t…

    dbt-labs dbt-mcp dbt-mcp PyPI