dbt-labs/dbt-mcp Security Advisories | GitStock

medium2026-06-19

dbt MCP Server: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens

GHSA-jr33-mw75-7j8f · CVE-2026-55837

low2026-05-14

dbt MCP Server Transmits All MCP Tool Arguments Including Raw SQL and --vars Credentials to dbt Labs Telemetry by Default Without Redaction

GHSA-jj54-r8gm-2fcf · CVE-2026-44970

low2026-05-14

dbt MCP Server Logs Tool Arguments Including SQL Queries and Credentials in Plaintext Without Redaction When File Logging Is Enabled

GHSA-7xgw-6qf3-7w59 · CVE-2026-44969

medium2026-05-14

dbt MCP Server has an Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters

GHSA-xpww-f6pm-cfhq · CVE-2026-44968