Priority HIGH 75
dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications.
dbt-labs
Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
dbt-labs records in CISA KEVNo dbt-labs vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
9 records
TI-2026-40302 CVE-2026-55837 · GHSA-jr33-mw75-7j8f
dbt-mcp: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens
Priority HIGH 65
dbt-mcp is a Model Context Protocol server for interacting with dbt.
TI-2024-23935 CVE-2024-36105 · GHSA-pmrx-695r-4349
dbt allows Binding to an Unrestricted IP Address via socketsocket
Priority MEDIUM 63
dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications.
TI-2026-32830 CVE-2026-44968 · GHSA-xpww-f6pm-cfhq
dbt-mcp: Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters
Priority MEDIUM 61
dbt-mcp is a Model Context Protocol server for interacting with dbt.
TI-2026-32832 CVE-2026-44970 · GHSA-jj54-r8gm-2fcf
dbt-mcp: All MCP Tool Arguments Including Raw SQL and --vars Credentials Transmitted to…
Priority MEDIUM 53
dbt-mcp is a Model Context Protocol server for interacting with dbt.
TI-2026-32831 CVE-2026-44969 · GHSA-7xgw-6qf3-7w59
Sensitive information in log files in dbt-labs dbt-mcp
Priority MEDIUM 49
dbt-mcp is a Model Context Protocol server for interacting with dbt.
TI-2026-28367 CVE-2026-39382
dbt has a Command Injection in Reusable Workflow via Unsanitized comment-body Output
Priority MEDIUM 48
dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications.
TI-2024-27049 CVE-2024-40637 · GHSA-p3f3-5ccg-83xq
Implicit override for built-in materializations from installed packages in dbt-core
Priority LOW 32
dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications.
TI-2026-23376 CVE-2026-29790 · GHSA-w75w-9qv4-j5xj
dbt-common: commonprefix() doesn't protect against path traversal
Priority LOW 11
dbt-common is the shared common utilities for dbt-core and adapter implementations use.