Model Context Protocol Server Log Exposure in dbt-mcp
CVE-2026-44969

2.5LOW

Key Information:

Vendor

Dbt-labs

Status
Dbt-mcp
Vendor
CVE Published:
16 July 2026

What is CVE-2026-44969?

The dbt-mcp Model Context Protocol server has a vulnerability where sensitive data such as SQL queries, variables, and node selections are logged in plaintext. This occurs in the DbtMCP.call_tool() method prior to version 1.17.1, where logs are recorded at INFO level before tool executions and at ERROR level during exceptions. The logging configuration allows these logs to be stored in the dbt-mcp.log file without automatic rotation or deletion, posing a risk of sensitive information exposure. The issue has been addressed in version 1.17.1.

Affected Version(s)

dbt-mcp < 1.17.1

References

https://github.com/dbt-labs/dbt-mcp/security/advisories/G...
x_refsource_CONFIRM
https://github.com/dbt-labs/dbt-mcp/pull/752
x_refsource_MISC
https://github.com/dbt-labs/dbt-mcp/commit/6534507b5e7a72...
x_refsource_MISC

CVSS V3.1

Score:
2.5
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.