dbt-labs dbt-mcp

• CVE-2026-55837 Medium 6.8 dbt-mcp: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens 0.3%
• CVE-2026-44969 Low 2.5 dbt-mcp: Tool Arguments Including SQL Queries and Credentials Logged in Plaintext Without Redaction When File Logging Is Enabled 0.2%
• CVE-2026-44970 Low 3.1 dbt-mcp: All MCP Tool Arguments Including Raw SQL and --vars Credentials Transmitted to dbt Labs Telemetry by Default Without Redaction 0.4%
• CVE-2026-44968 Medium 6.3 dbt-mcp: Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters 0.2%