Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-44969

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DbtMCP.call_tool() in src/dbt_mcp/mcp/server.py logged the raw arguments dictionary at INFO level before each tool call and at ERROR level on exceptions, and configure_file_logging() wrote those records to dbt-mcp.log when DBT_MCP_SERVER_FILE_LOGGING=true, preserving sensitive sql_query, vars, and node_selection values in plaintext without automatic rotation or deletion. This issue is fixed in version 1.17.1.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:d103ad268b7ec2bffb147764bf60142addef61294841d39bc5ef251b8aa7b493
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"dbt-mcp","vendor":"dbt-labs","versions":[{"status":"affected","version":"< 1.17.1"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7ec0368bb1d8812b89dbb42bc95616860827c8e1e50dfa2def6cf4d7cd39c5db · sha256:da646dfd153789fe… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":2.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:7ec0368bb1d8812b89dbb42bc95616860827c8e1e50dfa2def6cf4d7cd39c5db · sha256:da646dfd153789fe… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-532","description":"CWE-532: Insertion of Sensitive Information into Log File","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:7ec0368bb1d8812b89dbb42bc95616860827c8e1e50dfa2def6cf4d7cd39c5db · sha256:da646dfd153789fe… · /containers/cna/problemTypes/0/descriptions/0

Source references

5 source assertions
{"name":"https://github.com/dbt-labs/dbt-mcp/commit/6534507b5e7a729758d5baece155602cad0bb22f","tags":["x_refsource_MISC"],"url":"https://github.com/dbt-labs/dbt-mcp/commit/6534507b5e7a729758d5baece155602cad0bb22f"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:7ec0368bb1d8812b89dbb42bc95616860827c8e1e50dfa2def6cf4d7cd39c5db · sha256:da646dfd153789fe… · /containers/cna/references/2
{"name":"https://github.com/dbt-labs/dbt-mcp/pull/752","tags":["x_refsource_MISC"],"url":"https://github.com/dbt-labs/dbt-mcp/pull/752"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:7ec0368bb1d8812b89dbb42bc95616860827c8e1e50dfa2def6cf4d7cd39c5db · sha256:da646dfd153789fe… · /containers/cna/references/1
{"name":"https://github.com/dbt-labs/dbt-mcp/releases/tag/v1.17.1","tags":["x_refsource_MISC"],"url":"https://github.com/dbt-labs/dbt-mcp/releases/tag/v1.17.1"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:7ec0368bb1d8812b89dbb42bc95616860827c8e1e50dfa2def6cf4d7cd39c5db · sha256:da646dfd153789fe… · /containers/cna/references/3
{"tags":["exploit"],"url":"https://github.com/dbt-labs/dbt-mcp/security/advisories/GHSA-7xgw-6qf3-7w59"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:7ec0368bb1d8812b89dbb42bc95616860827c8e1e50dfa2def6cf4d7cd39c5db · sha256:da646dfd153789fe… · /containers/adp/0/references/0
{"name":"https://github.com/dbt-labs/dbt-mcp/security/advisories/GHSA-7xgw-6qf3-7w59","tags":["x_refsource_CONFIRM"],"url":"https://github.com/dbt-labs/dbt-mcp/security/advisories/GHSA-7xgw-6qf3-7w59"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:7ec0368bb1d8812b89dbb42bc95616860827c8e1e50dfa2def6cf4d7cd39c5db · sha256:da646dfd153789fe… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer