Skip to content
OpenAdvisories

Vendor

dbt-labs

9 known vulnerabilities.

Products

dbt-mcp 4 dbt-core 4 dbt-common 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 6.8
    CVE-2026-55837

    dbt-mcp: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens

    dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.20.0, the local OAuth helper in src/dbt_mcp/oauth/fastapi_app.py exposes GET /dbt_platform_context without authentication or Host validation after a user completes the dbt Platfor…

    dbt-labs dbt-mcp dbt-mcp PyPI
  • Medium 6.3
    CVE-2026-44968

    dbt-mcp: Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters

    dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, _run_dbt_command() in src/dbt_mcp/dbt_cli/tools.py appended unsanitized node_selection and resource_type values to the dbt subprocess argument list, allowing an MCP client t…

    dbt-labs dbt-mcp dbt-mcp PyPI
  • Medium 4.2
    CVE-2024-40637

    Implicit override for built-in materializations from installed packages in dbt-core

    dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user installs a package in dbt, it has the ability to override macros, materializations, and other core componen…

    dbt-labs dbt-core dbt-core PyPI
  • Medium 5.3
    CVE-2024-36105

    dbt allows Binding to an Unrestricted IP Address via socketsocket

    dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Prior to versions 1.6.15, 1.7.15, and 1.8.1, Binding to `INADDR_ANY (0.0.0.0)` or `IN6ADDR_ANY (::)` exposes an applica…

    dbt-labs dbt-core dbt-core PyPI