CVE-2026-55837 Details
Description
dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.20.0, the local OAuth helper in src/dbt_mcp/oauth/fastapi_app.py exposes GET /dbt_platform_context without authentication or Host validation after a user completes the dbt Platform OAuth flow. The endpoint returns the full DbtPlatformContext, including access_token and refresh_token values persisted by the context manager, to any process that can reach 127.0.0.1:6785. The absence of TrustedHostMiddleware allows a remote attacker to use DNS rebinding against a victim's browser because the helper accepts arbitrary Host headers, while a co-located process can request the endpoint directly. The stolen tokens provide immediate dbt Platform API access as the victim and persistent access through the refresh token, allowing access to or modification of projects, jobs, environment secrets, and related account data. This issue is fixed in version 1.20.0.
A vulnerability in dbt-mcp, a Model Context Protocol server for dbt interaction, allows for an unauthenticated leak of OAuth tokens. This issue exists in versions prior to 1.20.0. The local OAuth helper in fastapi_app.py exposes a GET endpoint, /dbt_platform_context, without authentication or proper Host validation. After completing the dbt Platform OAuth flow, this endpoint returns the full DbtPlatformContext, including sensitive access_token and refresh_token values, to any process that can access 127.0.0.1:6785. The lack of TrustedHostMiddleware enables remote attackers to exploit DNS rebinding against a victim's browser, while co-located processes can directly request the endpoint. The leaked tokens provide immediate access to the dbt Platform API and persistent access through the refresh token, allowing unauthorized access to projects, jobs, environment secrets, and related account data.
Users can upgrade to dbt-mcp version 1.20.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 14, 2026CISA-ADP
Assessed Sep 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dbt-labs/dbt-mcp/security/advisories/GHSA-jr33-mw75-7j8f | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/dbt-labs/dbt-mcp/commit/b8bdb40f90ed29f6b36176c5f6c697aa27a035a9 | [email protected] | Source CodeVendor |
| https://github.com/dbt-labs/dbt-mcp/pull/789 | [email protected] | Issue TrackingVendor |
| https://github.com/dbt-labs/dbt-mcp/releases/tag/v1.20.0 | [email protected] | Release NotesVendor |
| https://github.com/dbt-labs/dbt-mcp/security/advisories/GHSA-jr33-mw75-7j8f | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-346 | Origin Validation Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dbt-labs dbt-mcp | < 1.20.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | CVE Modified | CISA-ADP |
| Sep 14, 2026 | New CVE Received | [email protected] |