CVE-2026-44968 Details
Description
dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, _run_dbt_command() in src/dbt_mcp/dbt_cli/tools.py appended unsanitized node_selection and resource_type values to the dbt subprocess argument list, allowing an MCP client to inject dbt global flags such as --profiles-dir, --project-dir, and --target into subprocess.Popen even though shell=False prevents shell metacharacter injection. This issue is fixed in version 1.17.1.
A vulnerability exists in dbt-mcp, a Model Context Protocol server for dbt interaction, prior to version 1.17.1. The issue arises in the _run_dbt_command() function, where user-supplied node_selection and resource_type values are appended to the dbt subprocess argument list without proper sanitization. This flaw allows MCP clients to inject global dbt flags, such as --profiles-dir, --project-dir, and --target, into subprocess.Popen. Although shell metacharacter injection is prevented, this does not mitigate the risk of argument list injection, where attacker-controlled tokens are interpreted as flags by the target process.
Users can update to dbt-mcp version 1.17.1 or later, where this vulnerability has been fixed. In the updated version, the input validation for dbt CLI tool parameters has been improved to prevent such injection attacks.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dbt-labs/dbt-mcp/security/advisories/GHSA-xpww-f6pm-cfhq | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/dbt-labs/dbt-mcp/commit/6534507b5e7a729758d5baece155602cad0bb22f | [email protected] | Patch |
| https://github.com/dbt-labs/dbt-mcp/pull/752 | [email protected] | Issue TrackingPatch |
| https://github.com/dbt-labs/dbt-mcp/releases/tag/v1.17.1 | [email protected] | Release Notes |
| https://github.com/dbt-labs/dbt-mcp/security/advisories/GHSA-xpww-f6pm-cfhq | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-88 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| getdbt dbt mcp server | < 1.17.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | Initial Analysis | [email protected] |
| Jul 17, 2026 | CVE Modified | CISA-ADP |
| Jul 16, 2026 | New CVE Received | [email protected] |