Log in Start free

dbt-labs

Products

ProductCVEsExploitedLatest
dbt-core4–Oct 14, 2026
dbt-mcp4–Sep 14, 2026
dbt-common1–Mar 6, 2026

Exploited and recent CVEs

  • CVE-2026-100406 High 8.2 dbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve` 0.4%
  • CVE-2026-55837 Medium 6.8 dbt-mcp: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens 0.3%
  • CVE-2026-44969 Low 2.5 dbt-mcp: Tool Arguments Including SQL Queries and Credentials Logged in Plaintext Without Redaction When File Logging Is Enabled 0.2%
  • CVE-2026-44970 Low 3.1 dbt-mcp: All MCP Tool Arguments Including Raw SQL and --vars Credentials Transmitted to dbt Labs Telemetry by Default Without Redaction 0.4%
  • CVE-2026-44968 Medium 6.3 dbt-mcp: Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters 0.2%
  • CVE-2026-39382 Critical 9.3 dbt has a Command Injection in Reusable Workflow via Unsanitized comment-body Output 0.4%
  • CVE-2026-29790 Low 2.0 dbt-common: commonprefix() doesn't protect against path traversal 0.3%
  • CVE-2024-40637 Medium 4.2 Implicit override for built-in materializations from installed packages in dbt-core 0.4%
  • CVE-2024-36105 Medium 5.3 dbt allows Binding to an Unrestricted IP Address via socketsocket 0.7%