Unauthenticated SQL Query Exposure in dbt Product from dbt Labs
CVE-2026-100406

8.2HIGH

Key Information:

Vendor

Dbt-labs

Status
Dbt-core
Vendor
CVE Published:
14 October 2026

What is CVE-2026-100406?

A vulnerability in dbt versions from 2.0.0-alpha.0 to 2.0.0-alpha.5 allows unauthenticated clients to access the POST /api/v1/query endpoint. This exposure permits the execution of arbitrary SQL queries, enabling clients to read sensitive files outside the intended directory through DuckDB's filesystem functions. Although the server generally binds to localhost, configurations can lead to unintended network exposure, increasing the risk of unauthorized data access. The issue has been addressed in dbt version 2.0.0-alpha.5, which is crucial for maintaining the security integrity of data operations.

Affected Version(s)

dbt-core >= 2.0.0-alpha.0, < 2.0.0-alpha.5

References

https://github.com/dbt-labs/dbt/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/dbt-labs/dbt/commit/3a5d26fe02b5838272...
x_refsource_MISC
https://github.com/dbt-labs/dbt/releases/tag/v2.0.0-alpha.5
x_refsource_MISC

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.