What’s Vulnerable › Products

dbt-labs dbt-mcp vulnerabilities

4 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your dbt-labs dbt-mcp version is affected

Latest dbt-labs dbt-mcp vulnerabilities

• CVE-2026-55837 — dbt-mcp: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens (CVSS 6.8)
• CVE-2026-44970 — dbt-mcp: All MCP Tool Arguments Including Raw SQL and --vars Credentials Transmitted to dbt Labs Telemetry by Default Without Redaction (CVSS 4.3)
• CVE-2026-44969 — dbt-mcp: Tool Arguments Including SQL Queries and Credentials Logged in Plaintext Without Redaction When File Logging Is Enabled (CVSS 3.3)
• CVE-2026-44968 — dbt-mcp: Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters (CVSS 6.3)