Skip to content
OpenAdvisories

Vendor

dbt-labs

9 known vulnerabilities.

Products

dbt-mcp 4 dbt-core 4 dbt-common 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Low 2.5
    CVE-2026-44969

    dbt-mcp: Tool Arguments Including SQL Queries and Credentials Logged in Plaintext Without Redaction When File Logging Is Enabled

    dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DbtMCP.call_tool() in src/dbt_mcp/mcp/server.py logged the raw arguments dictionary at INFO level before each tool call and at ERROR level on exceptions, and configure_file_…

    dbt-labs dbt-mcp dbt-mcp PyPI
  • Low 3.1
    CVE-2026-44970

    dbt-mcp: All MCP Tool Arguments Including Raw SQL and --vars Credentials Transmitted to dbt Labs Telemetry by Default Without Redaction

    dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DefaultUsageTracker.emit_tool_called_event() in src/dbt_mcp/tracking/tracking.py serialized every MCP tool call's complete arguments dictionary and sent it through dbtlabs_v…

    dbt-labs dbt-mcp dbt-mcp PyPI
  • Low 2.0
    CVE-2026-29790

    dbt-common: commonprefix() doesn't protect against path traversal

    dbt-common is the shared common utilities for dbt-core and adapter implementations use. Prior to versions 1.34.2 and 1.37.3, a path traversal vulnerability exists in dbt-common's safe_extract() function used when extracting tarball archives. The function uses…

    dbt-labs dbt-common dbt-common PyPI