LOW2.5PyPI
PYSEC-2026-2441· CVE-2026-44969, GHSA-7xgw-6qf3-7w59dbt MCP Server Logs Tool Arguments Including SQL Queries and Credentials in Plaintext Without Redaction When File Logging Is Enabled
Modified: 7/13/2026
package
PyPI/dbt-mcp
pkg:pypi/dbt-mcp
LOW3.1PyPI
PYSEC-2026-2442· CVE-2026-44970, GHSA-jj54-r8gm-2fcfdbt MCP Server Transmits All MCP Tool Arguments Including Raw SQL and --vars Credentials to dbt Labs Telemetry by Default Without Redaction
Modified: 7/13/2026
MEDIUM6.8PyPI
PYSEC-2026-2443· CVE-2026-55837, GHSA-jr33-mw75-7j8fdbt MCP Server: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens
Modified: 7/13/2026
MEDIUM6.3PyPI
PYSEC-2026-2444· CVE-2026-44968, GHSA-xpww-f6pm-cfhqdbt MCP Server has an Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters
Modified: 7/13/2026
LOW2.5PyPI
GHSA-7xgw-6qf3-7w59· CVE-2026-44969, PYSEC-2026-2441dbt MCP Server Logs Tool Arguments Including SQL Queries and Credentials in Plaintext Without Redaction When File Logging Is Enabled
Modified: 7/13/2026
LOW3.1PyPI
GHSA-jj54-r8gm-2fcf· CVE-2026-44970, PYSEC-2026-2442dbt MCP Server Transmits All MCP Tool Arguments Including Raw SQL and --vars Credentials to dbt Labs Telemetry by Default Without Redaction
Modified: 7/13/2026
MEDIUM6.8PyPI
GHSA-jr33-mw75-7j8f· CVE-2026-55837, PYSEC-2026-2443dbt MCP Server: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens
Modified: 7/13/2026
MEDIUM6.3PyPI
GHSA-xpww-f6pm-cfhq· CVE-2026-44968, PYSEC-2026-2444dbt MCP Server has an Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters
Modified: 7/13/2026