Vulnerabilities

TI-2026-74399 CVE-2026-100406

Unauthenticated SQL execution in dbt docs serve reads local files

HIGH 75

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00423 Published 2026-10-14 Fixed in 2.0.0-alpha.5 CWE-200

TI-2026-40302 CVE-2026-55837 · GHSA-jr33-mw75-7j8f

HIGH 65

dbt-mcp is a Model Context Protocol server for interacting with dbt.

CVSS 3.1MEDIUM 6.8 Network No auth User interaction EPSS 0.00273 Published 2026-09-14 Fixed in 1.20.0 CWE-200

TI-2026-32831 CVE-2026-44969 · GHSA-7xgw-6qf3-7w59

MEDIUM 49

dbt-mcp is a Model Context Protocol server for interacting with dbt.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00165 Published 2026-07-16 Fixed in 1.17.1 CWE-532

TI-2026-32832 CVE-2026-44970 · GHSA-jj54-r8gm-2fcf

MEDIUM 53

dbt-mcp is a Model Context Protocol server for interacting with dbt.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00373 Published 2026-07-16 Fixed in 1.17.1 CWE-201

TI-2026-32830 CVE-2026-44968 · GHSA-xpww-f6pm-cfhq

MEDIUM 61

dbt-mcp is a Model Context Protocol server for interacting with dbt.

CVSS 3.1MEDIUM 6.3 Local Low privileges No interaction EPSS 0.00206 Published 2026-07-16 Fixed in 1.17.1 CWE-88

TI-2026-28367 CVE-2026-39382

MEDIUM 48

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00401 Published 2026-04-07 No fix listed CWE-78

TI-2026-23376 CVE-2026-29790 · GHSA-w75w-9qv4-j5xj

LOW 11

dbt-common is the shared common utilities for dbt-core and adapter implementations use.

CVSS 4.0LOW 2.0 Network Low privileges User interaction EPSS 0.00306 Published 2026-03-06 Fixed in 1.37.3, 1.34.2 CWE-22

TI-2024-27049 CVE-2024-40637 · GHSA-p3f3-5ccg-83xq

LOW 32

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications.

CVSS 3.1HIGH 7.3 Local Low privileges User interaction EPSS 0.00374 Published 2024-07-16 Fixed in 1.6.14, 1.7.14 CWE-74

TI-2024-23935 CVE-2024-36105 · GHSA-pmrx-695r-4349

MEDIUM 63

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0071 Published 2024-05-27 Fixed in 1.6.15, 1.7.15 +1 CWE-1327