Read the docs
TI-2026-74399 Aliases CVE-2026-100406

Unauthenticated SQL execution in dbt docs serve reads local files

Priority HIGH 75CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-306.

Summary

dbt-core from 2.0.0-alpha.0 before 2.0.0-alpha.5 has an unauthenticated POST /api/v1/query endpoint in dbt docs serve that runs caller-supplied SQL without authorization (CWE-306). A client that can reach the server can use DuckDB file-reading functions to read files the dbt process can access, including files outside the docs index directory. The server binds to localhost by default, but operators can expose it to a network through the DBT_DOCS_HOST setting.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src/handlers/query.rs, which passes caller-supplied SQL to DuckDbViewsBackend::query_arrow() in crates/dbt-index-core/src/backend.rs without authorization or an allowlist. A client that can reach the server can invoke DuckDB filesystem-reading functions to read files available to the dbt process, including files outside the docs index directory. The server binds to localhost by default, but operators can expose it to a network through the host option or DBT_DOCS_HOST setting. This issue is fixed in version 2.0.0-alpha.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00423 36th percentileScored 2026-11-08
Fix Fixed dbt-core (dbt-labs): 2.0.0-alpha.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
dbt-labsdbt-core2.0.0-alpha.0 to before 2.0.0-alpha.52.0.0-alpha.5Patch availableCNA
  • dbt-core Vendordbt-labs Affected 2.0.0-alpha.0 to before 2.0.0-alpha.5 Fixed in 2.0.0-alpha.5 Patch available CNA

Remediation

Upgrade dbt-core to 2.0.0-alpha.5, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA dbt-core (dbt-labs) Fixed in 2.0.0-alpha.5

Timeline

  1. 2026-10-15 Threatist record created from CVE-2026-100406
  2. 2026-10-16 Priority changed: MEDIUM → LOW
  3. 2026-10-20 CISA SSVC decision points changed
  4. 2026-10-20 Priority changed: LOW → HIGH

References

Other 3

  • TI-2026-40302 dbt-mcp: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens CVSS 3.1MEDIUM 6.8
  • TI-2024-23935 dbt allows Binding to an Unrestricted IP Address via socketsocket CVSS 3.1MEDIUM 5.3
  • TI-2026-32830 dbt-mcp: Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters CVSS 3.1MEDIUM 6.3
  • TI-2026-32832 dbt-mcp: All MCP Tool Arguments Including Raw SQL and --vars Credentials Transmitted to… CVSS 3.1MEDIUM 4.3
  • TI-2026-32831 Sensitive information in log files in dbt-labs dbt-mcp CVSS 3.1LOW 3.3
  • TI-2026-28367 dbt has a Command Injection in Reusable Workflow via Unsanitized comment-body Output CVSS 4.0CRITICAL 9.3
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences