Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

dbt-mcp

4 known vulnerabilities (2 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 2 medium, 2 low
Registry
PyPI

Advisories 4

  • CVE-2026-55837Medium 6.8

    dbt-mcp: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens

    Affected: fixed in 1.20.0.

  • dbt-mcp: Tool Arguments Including SQL Queries and Credentials Logged in Plaintext Without Redaction When File Logging Is Enabled

    Affected: fixed in 1.17.1.

  • dbt-mcp: All MCP Tool Arguments Including Raw SQL and --vars Credentials Transmitted to dbt Labs Telemetry by Default Without Redaction

    Affected: fixed in 1.17.1.

  • CVE-2026-44968Medium 6.3

    dbt-mcp: Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters

    Affected: fixed in 1.17.1.