PT-2026-41149 · Dbt-Mcp · Dbt-Mcp

CVE-2026-44969 · Published 2026-05-14 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions dbt-mcp versions prior to 1.17.1

Description dbt-mcp is a Model Context Protocol server for interacting with dbt. The DbtMCP.call tool() function in src/dbt mcp/mcp/server.py logs the raw arguments dictionary at the INFO level before every tool call and at the ERROR level when exceptions occur. When the DBT MCP SERVER FILE LOGGING variable is set to true, the configure file logging() function writes these logs to dbt-mcp.log in plaintext. This results in the exposure of sensitive data, including sql query, vars, and node selection values, which persist on disk without automatic rotation or deletion.

Recommendations Update to version 1.17.1. As a temporary mitigation, set the DBT MCP SERVER FILE LOGGING variable to false to prevent sensitive arguments from being written to the log file.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2026-44969

GHSA-7XGW-6QF3-7W59

PYSEC-2026-2441

Affected Products

Dbt-Mcp

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44969.json · Exploit
• 🔥 https://github.com/dbt-labs/dbt-mcp/security/advisories/GHSA-7xgw-6qf3-7w59 · Exploit
• https://github.com/dbt-labs/dbt-mcp/pull/752 · Patch
• https://github.com/dbt-labs/dbt-mcp/commit/6534507b5e7a729758d5baece155602cad0bb22f · Patch
• https://osv.dev/vulnerability/PYSEC-2026-2441 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-44969 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44969 · Security Note
• https://osv.dev/vulnerability/GHSA-7xgw-6qf3-7w59 · Vendor Advisory
• https://github.com/dbt-labs/dbt-mcp/releases/tag/v1.17.1 · Note
• https://github.com/dbt-labs/dbt-mcp · Note
• https://pypi.org/project/dbt-mcp · Note
• https://twitter.com/infoflowcloud/status/2077842338789949866 · Twitter Post
• https://t.me/cveNotify/209216 · Telegram Post
• https://github.com/advisories/GHSA-7xgw-6qf3-7w59 · Note
• https://twitter.com/CVEnew/status/2077841140527862141 · Twitter Post