Model Context Protocol Server Vulnerability in dbt-MCP by dbt Labs
CVE-2026-44970

3.1LOW

Key Information:

Vendor

Dbt-labs

Status
Dbt-mcp
Vendor
CVE Published:
16 July 2026

What is CVE-2026-44970?

A vulnerability in dbt-mcp allows the DefaultUsageTracker to serialize and transmit sensitive tool call parameters, including SQL queries and execution variables, without proper redaction. This issue arises from default telemetry settings that enabled data collection unless explicitly disabled. Users are encouraged to update to version 1.17.1 where this risk is mitigated by implementing necessary redaction of sensitive data.

Affected Version(s)

dbt-mcp < 1.17.1

References

https://github.com/dbt-labs/dbt-mcp/security/advisories/G...
x_refsource_CONFIRM
https://github.com/dbt-labs/dbt-mcp/pull/752
x_refsource_MISC
https://github.com/dbt-labs/dbt-mcp/commit/6534507b5e7a72...
x_refsource_MISC

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.