CVE-2026-44969 Details
Description
dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DbtMCP.call_tool() in src/dbt_mcp/mcp/server.py logged the raw arguments dictionary at INFO level before each tool call and at ERROR level on exceptions, and configure_file_logging() wrote those records to dbt-mcp.log when DBT_MCP_SERVER_FILE_LOGGING=true, preserving sensitive sql_query, vars, and node_selection values in plaintext without automatic rotation or deletion. This issue is fixed in version 1.17.1.
A vulnerability exists in dbt-mcp, a Model Context Protocol server for dbt interaction, in versions prior to 1.17.1. The issue arises because the 'DbtMCP.call_tool()' method logs raw argument dictionaries at INFO level before each tool call, and at ERROR level when exceptions occur. This logging, which includes sensitive information such as SQL queries, variable data, and node selection values, is written in plaintext to a log file when file logging is enabled. The unredacted data can remain on disk indefinitely without any automatic rotation or deletion.
Users can update to dbt-mcp version 1.17.1 or later, where this vulnerability has been fixed. In the updated version, the logging of tool arguments has been improved to redact sensitive information such as SQL queries and variable values before they are written to the log file.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dbt-labs/dbt-mcp/security/advisories/GHSA-7xgw-6qf3-7w59 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/dbt-labs/dbt-mcp/commit/6534507b5e7a729758d5baece155602cad0bb22f | [email protected] | Patch |
| https://github.com/dbt-labs/dbt-mcp/pull/752 | [email protected] | Issue TrackingPatch |
| https://github.com/dbt-labs/dbt-mcp/releases/tag/v1.17.1 | [email protected] | Release Notes |
| https://github.com/dbt-labs/dbt-mcp/security/advisories/GHSA-7xgw-6qf3-7w59 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-532 | Insertion of Sensitive Information into Log File | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| getdbt dbt mcp server | < 1.17.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | Initial Analysis | [email protected] |
| Jul 17, 2026 | CVE Modified | CISA-ADP |
| Jul 16, 2026 | New CVE Received | [email protected] |