Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens Summary The local OAuth helper FastAPI server bundled with dbt-mcp exposes the GET /dbtplatformcontext endpoint without any form of authentication or host-origin validation. After a user completes the OAuth login flow against dbt Cloud (cloud.getdbt.com), the endpoint returns the full DbtPlatformContext object — including the victim's accesstoken and refreshtoken for the dbt Platform API — verbatim to any caller that can reach 127.0.0.1:6785. An attacker who can direct the victim's browser to the helper origin via DNS rebinding, or who has co-located process access on the same host, can silently exfiltrate both tokens. The stolen bearer token grants full dbt Cloud API access as the victim; the refresh token enables persistent access beyond the original token's expiry. CVSS Base Score: 8.0 (High). Details During the OAuth login flow, dbt-mcp launches an embedded FastAPI server (the "OAuth helper") bound to 127.0.0.1…
Recommended action: Upgrade to 1.20.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Discovered through manual source code review. Verified by PoC execution against a local dbt-mcp v1.15.1 installation. Summary DefaultUsageTracker.emittoolcalledevent() in src/dbtmcp/tracking/tracking.py serializes the complete arguments dictionary of every MCP tool call and transmits it verbatim to the dbt Labs telemetry service via dbtlabsvortex.producer.logproto. No field is redacted, truncated, or excluded before transmission. This includes the sqlquery parameter of the show tool (arbitrary SQL) and the vars parameter of run, build, and test (JSON string that may contain credentials). Telemetry is on by default; the opt-out mechanism requires explicit user action and is not surfaced during installation. Details Serialization code (tracking.py lines 101–103): Every key-value pair in arguments is JSON-serialized into argumentsmapping and passed to logproto(ToolCalled(...)). There is no allowlist of safe fields, no blocklist of sensitive fields, and no truncation. Default opt-out…
Recommended action: Upgrade to 1.17.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Discovered through manual source code review. Verified by PoC execution against a local dbt-mcp v1.15.1 installation. Summary DbtMCP.calltool() in src/dbtmcp/mcp/server.py logs the complete raw arguments dictionary at INFO level on every tool invocation (line 67) and again at ERROR level if the call raises an exception (lines 77–79). No field is redacted before logging. When the documented DBTMCPSERVERFILELOGGING=true feature is enabled, these log records are written to dbt-mcp.log in the project root directory as plaintext. Sensitive data — raw SQL queries, --vars payloads carrying credentials, node selectors — persists on disk indefinitely with no automatic rotation or deletion. Details Vulnerable log statements (server.py): arguments is the raw Python dict received from the MCP client. It is string-interpolated directly into the log message. On a tool call that raises an exception, the same dict is logged twice — once at INFO and once at ERROR. File logging is activated by…
Recommended action: Upgrade to 1.17.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Discovered through manual source code review. Verified by PoC execution against a local dbt-mcp v1.15.1 installation. Summary rundbtcommand() in src/dbtmcp/dbtcli/tools.py constructs the dbt subprocess argument list by appending user-supplied MCP tool parameters without sanitization. Two independent injection vectors exist. An MCP client can inject arbitrary dbt global flags — such as --profiles-dir, --project-dir, and --target — by crafting the nodeselection string (Vector 1) or the resourcetype JSON array (Vector 2). Because subprocess.Popen is called with shell=False and a list argument, shell metacharacter injection is not possible; however, this provides no defense against argument list injection (CWE-88), where attacker-controlled tokens are interpreted by the target process as flags rather than values. Details Vector 1 — nodeselection string Affected tools: build, compile, run, test, clone, list, getnodedetailsdev str.split(" ") does not distinguish dbt selector tokens from…
Recommended action: Upgrade to 1.17.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.