Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-44969

23
FAUCET Score

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DbtMCP.call_tool() in src/dbt_mcp/mcp/server.py logged the raw arguments dictionary at INFO level before each tool call and at ERROR level on exceptions, and configure_file_logging() wrote those records to dbt-mcp.log when DBT_MCP_SERVER_FILE_LOGGING=true, preserving sensitive sql_query, vars, and node_selection values in plaintext without automatic rotation or deletion. This issue is fixed in version 1.17.1.

First published: Jul 16, 2026Last modified: Jul 16, 2026

Impacted Technologies

VendorProductVersion(s)CPE
< 1.17.1CPE matchmatch criteria
cpe:2.3:a:getdbt:dbt_mcp_server:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

2.5LOW

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
Exploitability Score
1.0
Impact Score
1.4
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.15%
Probability of exploitation in next 30 days
EPSS Percentile
4.5%
Percentile rank of EPSS score among Peer Group
As of 2026-07-26
Model: v2026.06.15
This CVE's current EPSS score of 0.0015 is in the 32nd percentile among its peer group of 1,509 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (1)

pippatch availablevia ghsa
Product: dbt-mcpFixed in: 1.17.1

Vendor Advisories (1)

pipGHSA-7xgw-6qf3-7w59low

dbt MCP Server Logs Tool Arguments Including SQL Queries and Credentials in Plaintext Without Redaction When File Logging Is Enabled

May 14, 2026

References

github.com / dbt-labs/dbt-mcp/commit/6534507b5e7a729758d5baece155602cad0bb22f
Patch
github.com / dbt-labs/dbt-mcp/pull/752
Issue TrackingPatch
github.com / dbt-labs/dbt-mcp/releases/tag/v1.17.1
Release Notes
github.com / dbt-labs/dbt-mcp/security/advisories/GHSA-7xgw-6qf3-7w59
ExploitMitigationVendor Advisory