CVE-2026-44969 (GCVE-0-2026-44969)
Vulnerability from cvelistv5 – Published: 2026-07-16 17:49 – Updated: 2026-07-17 18:06
VLAI
EPSS
VEX
Title
dbt-mcp: Tool Arguments Including SQL Queries and Credentials Logged in Plaintext Without Redaction When File Logging Is Enabled
Summary
dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DbtMCP.call_tool() in src/dbt_mcp/mcp/server.py logged the raw arguments dictionary at INFO level before each tool call and at ERROR level on exceptions, and configure_file_logging() wrote those records to dbt-mcp.log when DBT_MCP_SERVER_FILE_LOGGING=true, preserving sensitive sql_query, vars, and node_selection values in plaintext without automatic rotation or deletion. This issue is fixed in version 1.17.1.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-17 17:18 UTC
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/dbt-labs/dbt-mcp/security/advi… | x_refsource_CONFIRM |
| https://github.com/dbt-labs/dbt-mcp/pull/752 | x_refsource_MISC |
| https://github.com/dbt-labs/dbt-mcp/commit/653450… | x_refsource_MISC |
| https://github.com/dbt-labs/dbt-mcp/releases/tag/… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44969",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T17:18:39.143169Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T18:06:51.913Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/dbt-labs/dbt-mcp/security/advisories/GHSA-7xgw-6qf3-7w59"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dbt-mcp",
"vendor": "dbt-labs",
"versions": [
{
"status": "affected",
"version": "\u003c 1.17.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DbtMCP.call_tool() in src/dbt_mcp/mcp/server.py logged the raw arguments dictionary at INFO level before each tool call and at ERROR level on exceptions, and configure_file_logging() wrote those records to dbt-mcp.log when DBT_MCP_SERVER_FILE_LOGGING=true, preserving sensitive sql_query, vars, and node_selection values in plaintext without automatic rotation or deletion. This issue is fixed in version 1.17.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 2.5,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532: Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T17:49:50.663Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/dbt-labs/dbt-mcp/security/advisories/GHSA-7xgw-6qf3-7w59",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/dbt-labs/dbt-mcp/security/advisories/GHSA-7xgw-6qf3-7w59"
},
{
"name": "https://github.com/dbt-labs/dbt-mcp/pull/752",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/dbt-labs/dbt-mcp/pull/752"
},
{
"name": "https://github.com/dbt-labs/dbt-mcp/commit/6534507b5e7a729758d5baece155602cad0bb22f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/dbt-labs/dbt-mcp/commit/6534507b5e7a729758d5baece155602cad0bb22f"
},
{
"name": "https://github.com/dbt-labs/dbt-mcp/releases/tag/v1.17.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/dbt-labs/dbt-mcp/releases/tag/v1.17.1"
}
],
"source": {
"advisory": "GHSA-7xgw-6qf3-7w59",
"discovery": "UNKNOWN"
},
"title": "dbt-mcp: Tool Arguments Including SQL Queries and Credentials Logged in Plaintext Without Redaction When File Logging Is Enabled"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44969",
"datePublished": "2026-07-16T17:49:50.663Z",
"dateReserved": "2026-05-08T16:23:33.263Z",
"dateUpdated": "2026-07-17T18:06:51.913Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-44969",
"date": "2026-09-21",
"epss": "0.00165",
"percentile": "0.06137"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "dbt-mcp",
"vendor": "dbt-labs",
"versions": [
{
"status": "affected",
"version": "\u003c 1.17.1"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:getdbt:dbt_mcp_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A1454B23-5F05-44AF-9A3F-B233CF1DC3E5",
"versionEndExcluding": "1.17.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DbtMCP.call_tool() in src/dbt_mcp/mcp/server.py logged the raw arguments dictionary at INFO level before each tool call and at ERROR level on exceptions, and configure_file_logging() wrote those records to dbt-mcp.log when DBT_MCP_SERVER_FILE_LOGGING=true, preserving sensitive sql_query, vars, and node_selection values in plaintext without automatic rotation or deletion. This issue is fixed in version 1.17.1."
}
],
"id": "CVE-2026-44969",
"lastModified": "2026-07-21T16:05:03.330",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 2.5,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.0,
"impactScore": 1.4,
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-44969",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T17:18:39.143169Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-07-16T18:16:43.247",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/dbt-labs/dbt-mcp/commit/6534507b5e7a729758d5baece155602cad0bb22f"
},
{
"source": "security-advisories@github.com",
"tags": [
"Issue Tracking",
"Patch"
],
"url": "https://github.com/dbt-labs/dbt-mcp/pull/752"
},
{
"source": "security-advisories@github.com",
"tags": [
"Release Notes"
],
"url": "https://github.com/dbt-labs/dbt-mcp/releases/tag/v1.17.1"
},
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Mitigation",
"Vendor Advisory"
],
"url": "https://github.com/dbt-labs/dbt-mcp/security/advisories/GHSA-7xgw-6qf3-7w59"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Mitigation",
"Vendor Advisory"
],
"url": "https://github.com/dbt-labs/dbt-mcp/security/advisories/GHSA-7xgw-6qf3-7w59"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-532"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44969",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T17:18:39.143169Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T17:18:50.500Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/dbt-labs/dbt-mcp/security/advisories/GHSA-7xgw-6qf3-7w59"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dbt-mcp",
"vendor": "dbt-labs",
"versions": [
{
"status": "affected",
"version": "\u003c 1.17.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DbtMCP.call_tool() in src/dbt_mcp/mcp/server.py logged the raw arguments dictionary at INFO level before each tool call and at ERROR level on exceptions, and configure_file_logging() wrote those records to dbt-mcp.log when DBT_MCP_SERVER_FILE_LOGGING=true, preserving sensitive sql_query, vars, and node_selection values in plaintext without automatic rotation or deletion. This issue is fixed in version 1.17.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 2.5,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532: Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T17:49:50.663Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/dbt-labs/dbt-mcp/security/advisories/GHSA-7xgw-6qf3-7w59",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/dbt-labs/dbt-mcp/security/advisories/GHSA-7xgw-6qf3-7w59"
},
{
"name": "https://github.com/dbt-labs/dbt-mcp/pull/752",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/dbt-labs/dbt-mcp/pull/752"
},
{
"name": "https://github.com/dbt-labs/dbt-mcp/commit/6534507b5e7a729758d5baece155602cad0bb22f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/dbt-labs/dbt-mcp/commit/6534507b5e7a729758d5baece155602cad0bb22f"
},
{
"name": "https://github.com/dbt-labs/dbt-mcp/releases/tag/v1.17.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/dbt-labs/dbt-mcp/releases/tag/v1.17.1"
}
],
"source": {
"advisory": "GHSA-7xgw-6qf3-7w59",
"discovery": "UNKNOWN"
},
"title": "dbt-mcp: Tool Arguments Including SQL Queries and Credentials Logged in Plaintext Without Redaction When File Logging Is Enabled"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44969",
"datePublished": "2026-07-16T17:49:50.663Z",
"dateReserved": "2026-05-08T16:23:33.263Z",
"dateUpdated": "2026-07-17T18:06:51.913Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
FKIE_CVE-2026-44969
Vulnerability from fkie_nvd - Published: 2026-07-16 18:16 - Updated: 2026-07-21 16:05
Severity
2.5 (Low) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
3.3 (Low) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
3.3 (Low) - CVSS:3.1/
Summary
dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DbtMCP.call_tool() in src/dbt_mcp/mcp/server.py logged the raw arguments dictionary at INFO level before each tool call and at ERROR level on exceptions, and configure_file_logging() wrote those records to dbt-mcp.log when DBT_MCP_SERVER_FILE_LOGGING=true, preserving sensitive sql_query, vars, and node_selection values in plaintext without automatic rotation or deletion. This issue is fixed in version 1.17.1.
References
| URL | Tags | ||
|---|---|---|---|
| security-advisories@github.com | https://github.com/dbt-labs/dbt-mcp/commit/6534507b5e7a729758d5baece155602cad0bb22f | Patch | |
| security-advisories@github.com | https://github.com/dbt-labs/dbt-mcp/pull/752 | Issue Tracking, Patch | |
| security-advisories@github.com | https://github.com/dbt-labs/dbt-mcp/releases/tag/v1.17.1 | Release Notes | |
| security-advisories@github.com | https://github.com/dbt-labs/dbt-mcp/security/advisories/GHSA-7xgw-6qf3-7w59 | Exploit, Mitigation, Vendor Advisory | |
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | https://github.com/dbt-labs/dbt-mcp/security/advisories/GHSA-7xgw-6qf3-7w59 | Exploit, Mitigation, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| getdbt | dbt_mcp_server | * |
{
"affected": [
{
"affectedData": [
{
"product": "dbt-mcp",
"vendor": "dbt-labs",
"versions": [
{
"status": "affected",
"version": "\u003c 1.17.1"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:getdbt:dbt_mcp_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A1454B23-5F05-44AF-9A3F-B233CF1DC3E5",
"versionEndExcluding": "1.17.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DbtMCP.call_tool() in src/dbt_mcp/mcp/server.py logged the raw arguments dictionary at INFO level before each tool call and at ERROR level on exceptions, and configure_file_logging() wrote those records to dbt-mcp.log when DBT_MCP_SERVER_FILE_LOGGING=true, preserving sensitive sql_query, vars, and node_selection values in plaintext without automatic rotation or deletion. This issue is fixed in version 1.17.1."
}
],
"id": "CVE-2026-44969",
"lastModified": "2026-07-21T16:05:03.330",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 2.5,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.0,
"impactScore": 1.4,
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-44969",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T17:18:39.143169Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-07-16T18:16:43.247",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/dbt-labs/dbt-mcp/commit/6534507b5e7a729758d5baece155602cad0bb22f"
},
{
"source": "security-advisories@github.com",
"tags": [
"Issue Tracking",
"Patch"
],
"url": "https://github.com/dbt-labs/dbt-mcp/pull/752"
},
{
"source": "security-advisories@github.com",
"tags": [
"Release Notes"
],
"url": "https://github.com/dbt-labs/dbt-mcp/releases/tag/v1.17.1"
},
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Mitigation",
"Vendor Advisory"
],
"url": "https://github.com/dbt-labs/dbt-mcp/security/advisories/GHSA-7xgw-6qf3-7w59"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Mitigation",
"Vendor Advisory"
],
"url": "https://github.com/dbt-labs/dbt-mcp/security/advisories/GHSA-7xgw-6qf3-7w59"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-532"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
GHSA-7XGW-6QF3-7W59
Vulnerability from github – Published: 2026-05-14 18:24 – Updated: 2026-05-14 18:24
VLAI
Summary
dbt MCP Server Logs Tool Arguments Including SQL Queries and Credentials in Plaintext Without Redaction When File Logging Is Enabled
Details
Discovered through manual source code review. Verified by PoC execution against a local dbt-mcp v1.15.1 installation.
Summary
DbtMCP.call_tool() in src/dbt_mcp/mcp/server.py logs the complete raw arguments dictionary at INFO level on every tool invocation (line 67) and again at ERROR level if the call raises an exception (lines 77–79). No field is redacted before logging. When the documented DBT_MCP_SERVER_FILE_LOGGING=true feature is enabled, these log records are written to dbt-mcp.log in the project root directory as plaintext. Sensitive data — raw SQL queries, --vars payloads carrying credentials, node selectors — persists on disk indefinitely with no automatic rotation or deletion.
Details
Vulnerable log statements (server.py):
# Line 67 — emitted before every tool execution
logger.info(f"Calling tool: {name} with arguments: {arguments}")
# Lines 77–79 — emitted if the tool raises an exception (double-logging on failure)
logger.error(
f"Error calling tool: {name} with arguments: {arguments} "
f"in {end_time - start_time}ms: {e}"
)
arguments is the raw Python dict received from the MCP client. It is string-interpolated directly into the log message. On a tool call that raises an exception, the same dict is logged twice — once at INFO and once at ERROR.
File logging is activated by DBT_MCP_SERVER_FILE_LOGGING=true (a documented feature in the project README). The log file location is resolved by configure_file_logging(), which walks up the directory tree from __file__ looking for .git or pyproject.toml, falling back to $HOME. Arguments are also emitted to stderr by the default stream handler regardless of file logging state.
PoC
MCP client script — triggers real tool calls and verifies log file contents:
#!/usr/bin/env python3
# poc4_tool_args_logged.py
# Vulnerable code: src/dbt_mcp/mcp/server.py line 67, 77-79
# configure_file_logging(): src/dbt_mcp/telemetry/logging.py
import logging
from pathlib import Path
LOG_FILENAME = "dbt-mcp.log"
def configure_file_logging(log_level: int = logging.INFO) -> Path:
"""Reproduction of configure_file_logging() from telemetry/logging.py."""
module_path = Path(__file__).resolve().parent
home = Path.home().resolve()
for candidate in [module_path, *module_path.parents]:
if (candidate / ".git").exists() or (candidate / "pyproject.toml").exists() or candidate == home:
repo_root = candidate
break
log_path = repo_root / LOG_FILENAME
root_logger = logging.getLogger()
root_logger.setLevel(log_level)
file_handler = logging.FileHandler(log_path, encoding="utf-8")
file_handler.setLevel(log_level)
file_handler.setFormatter(
logging.Formatter("%(asctime)s %(levelname)s [%(name)s] %(message)s")
)
root_logger.addHandler(file_handler)
return log_path
log_path = configure_file_logging()
server_logger = logging.getLogger("dbt_mcp.mcp.server")
# Exact log statements from server.py line 67 and line 77-79
name = "show"
arguments = {"sql_query": "SELECT ssn, credit_card_number, salary FROM customers WHERE id = 42", "limit": 5}
server_logger.info(f"Calling tool: {name} with arguments: {arguments}")
name2 = "run"
arguments2 = {"node_selection": "sensitive_model", "vars": '{"db_password": "hunter2", "api_key": "sk-prod-abc123xyz"}', "is_full_refresh": False}
server_logger.info(f"Calling tool: {name2} with arguments: {arguments2}")
# Verify file contents
lines = log_path.read_text(encoding="utf-8").splitlines()
poc_lines = [l for l in lines if "dbt_mcp.mcp.server" in l]
print(f"[log file: {log_path}]")
for line in poc_lines:
print(f" {line}")
keywords = ["ssn", "credit_card_number", "salary", "db_password", "api_key"]
found = [kw for kw in keywords if any(kw in l for l in poc_lines)]
if found:
print(f"\n[CONFIRMED] Sensitive keywords in plaintext log: {found}")
print(f"[CONFIRMED] No redaction applied. File persists at {log_path}")
Expected log file entries:
2026-04-27 ... INFO [dbt_mcp.mcp.server] Calling tool: show with arguments:
{'sql_query': 'SELECT ssn, credit_card_number, salary FROM customers', 'limit': 5}
2026-04-27 ... INFO [dbt_mcp.mcp.server] Calling tool: run with arguments:
{'node_selection': 'sensitive_model',
'vars': '{"db_password":"hunter2","api_key":"sk-prod-abc123"}',
'is_full_refresh': False}
[CONFIRMED] Sensitive keywords in plaintext log: ['ssn', 'credit_card_number', 'salary', 'db_password', 'api_key']
[CONFIRMED] No redaction applied.
Impact
Directly proven by this PoC:
- When
DBT_MCP_SERVER_FILE_LOGGING=true, the fullargumentsdict of every tool call — includingsql_query,vars, andnode_selection— is written todbt-mcp.login plaintext on every invocation. - A tool call that raises an exception produces two log entries with the same sensitive content (INFO + ERROR double-logging).
- The log file has no automatic rotation, expiry, or access restriction beyond filesystem permissions.
Combined with Advisory 3 (telemetry), a single show tool call containing PII produces one telemetry transmission to dbt Labs and one (or two, on failure) persistent log entries on disk.
Remediation
redact known-sensitive argument values before logging:
_LOG_REDACT = frozenset({"sql_query", "vars"})
def _safe_args(arguments: dict) -> dict:
return {k: "***redacted***" if k in _LOG_REDACT else v
for k, v in arguments.items()}
# server.py line 67:
logger.info(f"Calling tool: {name} with arguments: {_safe_args(arguments)}")
# server.py lines 77-79:
logger.error(
f"Error calling tool: {name} with arguments: {_safe_args(arguments)} "
f"in {end_time - start_time}ms: {e}"
)
log argument keys only:
logger.info(f"Calling tool: {name} with argument keys: {list(arguments.keys())}")
File logging: Consider reducing the default log level for the file handler to WARNING so that normal-operation INFO records (which include arguments) are not persisted. Sensitive content would only appear in file logs on error.
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.17.0"
},
"package": {
"ecosystem": "PyPI",
"name": "dbt-mcp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.17.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-44969"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-14T18:24:44Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "*Discovered through manual source code review. Verified by PoC execution against a local dbt-mcp v1.15.1 installation.*\n\n### Summary\n\n`DbtMCP.call_tool()` in `src/dbt_mcp/mcp/server.py` logs the complete raw `arguments` dictionary at `INFO` level on every tool invocation (line 67) and again at `ERROR` level if the call raises an exception (lines 77\u201379). No field is redacted before logging. When the documented `DBT_MCP_SERVER_FILE_LOGGING=true` feature is enabled, these log records are written to `dbt-mcp.log` in the project root directory as plaintext. Sensitive data \u2014 raw SQL queries, `--vars` payloads carrying credentials, node selectors \u2014 persists on disk indefinitely with no automatic rotation or deletion.\n\n### Details\n\n**Vulnerable log statements (`server.py`):**\n\n```python\n# Line 67 \u2014 emitted before every tool execution\nlogger.info(f\"Calling tool: {name} with arguments: {arguments}\")\n\n# Lines 77\u201379 \u2014 emitted if the tool raises an exception (double-logging on failure)\nlogger.error(\n f\"Error calling tool: {name} with arguments: {arguments} \"\n f\"in {end_time - start_time}ms: {e}\"\n)\n```\n\n`arguments` is the raw Python dict received from the MCP client. It is string-interpolated directly into the log message. On a tool call that raises an exception, the same dict is logged twice \u2014 once at INFO and once at ERROR.\n\nFile logging is activated by `DBT_MCP_SERVER_FILE_LOGGING=true` (a documented feature in the project README). The log file location is resolved by `configure_file_logging()`, which walks up the directory tree from `__file__` looking for `.git` or `pyproject.toml`, falling back to `$HOME`. Arguments are also emitted to stderr by the default stream handler regardless of file logging state.\n\n### PoC\n\n**MCP client script \u2014 triggers real tool calls and verifies log file contents:**\n\n```python\n#!/usr/bin/env python3\n# poc4_tool_args_logged.py\n# Vulnerable code: src/dbt_mcp/mcp/server.py line 67, 77-79\n# configure_file_logging(): src/dbt_mcp/telemetry/logging.py\n\nimport logging\nfrom pathlib import Path\n\nLOG_FILENAME = \"dbt-mcp.log\"\n\ndef configure_file_logging(log_level: int = logging.INFO) -\u003e Path:\n \"\"\"Reproduction of configure_file_logging() from telemetry/logging.py.\"\"\"\n module_path = Path(__file__).resolve().parent\n home = Path.home().resolve()\n for candidate in [module_path, *module_path.parents]:\n if (candidate / \".git\").exists() or (candidate / \"pyproject.toml\").exists() or candidate == home:\n repo_root = candidate\n break\n log_path = repo_root / LOG_FILENAME\n root_logger = logging.getLogger()\n root_logger.setLevel(log_level)\n file_handler = logging.FileHandler(log_path, encoding=\"utf-8\")\n file_handler.setLevel(log_level)\n file_handler.setFormatter(\n logging.Formatter(\"%(asctime)s %(levelname)s [%(name)s] %(message)s\")\n )\n root_logger.addHandler(file_handler)\n return log_path\n\nlog_path = configure_file_logging()\nserver_logger = logging.getLogger(\"dbt_mcp.mcp.server\")\n\n# Exact log statements from server.py line 67 and line 77-79\nname = \"show\"\narguments = {\"sql_query\": \"SELECT ssn, credit_card_number, salary FROM customers WHERE id = 42\", \"limit\": 5}\nserver_logger.info(f\"Calling tool: {name} with arguments: {arguments}\")\n\nname2 = \"run\"\narguments2 = {\"node_selection\": \"sensitive_model\", \"vars\": \u0027{\"db_password\": \"hunter2\", \"api_key\": \"sk-prod-abc123xyz\"}\u0027, \"is_full_refresh\": False}\nserver_logger.info(f\"Calling tool: {name2} with arguments: {arguments2}\")\n\n# Verify file contents\nlines = log_path.read_text(encoding=\"utf-8\").splitlines()\npoc_lines = [l for l in lines if \"dbt_mcp.mcp.server\" in l]\nprint(f\"[log file: {log_path}]\")\nfor line in poc_lines:\n print(f\" {line}\")\n\nkeywords = [\"ssn\", \"credit_card_number\", \"salary\", \"db_password\", \"api_key\"]\nfound = [kw for kw in keywords if any(kw in l for l in poc_lines)]\nif found:\n print(f\"\\n[CONFIRMED] Sensitive keywords in plaintext log: {found}\")\n print(f\"[CONFIRMED] No redaction applied. File persists at {log_path}\")\n```\n\n**Expected log file entries:**\n\n````\n2026-04-27 ... INFO [dbt_mcp.mcp.server] Calling tool: show with arguments:\n {\u0027sql_query\u0027: \u0027SELECT ssn, credit_card_number, salary FROM customers\u0027, \u0027limit\u0027: 5}\n\n2026-04-27 ... INFO [dbt_mcp.mcp.server] Calling tool: run with arguments:\n {\u0027node_selection\u0027: \u0027sensitive_model\u0027,\n \u0027vars\u0027: \u0027{\"db_password\":\"hunter2\",\"api_key\":\"sk-prod-abc123\"}\u0027,\n \u0027is_full_refresh\u0027: False}\n\n[CONFIRMED] Sensitive keywords in plaintext log: [\u0027ssn\u0027, \u0027credit_card_number\u0027, \u0027salary\u0027, \u0027db_password\u0027, \u0027api_key\u0027]\n[CONFIRMED] No redaction applied.\n````\n\n\u003cimg width=\"3798\" height=\"462\" alt=\"image\" src=\"https://github.com/user-attachments/assets/b4c23a93-b3d3-4b7f-ba46-3d4a324d609f\" /\u003e\n\n### Impact\n\n**Directly proven by this PoC:**\n\n- When `DBT_MCP_SERVER_FILE_LOGGING=true`, the full `arguments` dict of every tool call \u2014 including `sql_query`, `vars`, and `node_selection` \u2014 is written to `dbt-mcp.log` in plaintext on every invocation.\n- A tool call that raises an exception produces **two** log entries with the same sensitive content (INFO + ERROR double-logging).\n- The log file has no automatic rotation, expiry, or access restriction beyond filesystem permissions.\n\nCombined with Advisory 3 (telemetry), a single `show` tool call containing PII produces one telemetry transmission to dbt Labs **and** one (or two, on failure) persistent log entries on disk.\n\n### Remediation\n\n**redact known-sensitive argument values before logging:**\n\n```python\n_LOG_REDACT = frozenset({\"sql_query\", \"vars\"})\n\ndef _safe_args(arguments: dict) -\u003e dict:\n return {k: \"***redacted***\" if k in _LOG_REDACT else v\n for k, v in arguments.items()}\n\n# server.py line 67:\nlogger.info(f\"Calling tool: {name} with arguments: {_safe_args(arguments)}\")\n\n# server.py lines 77-79:\nlogger.error(\n f\"Error calling tool: {name} with arguments: {_safe_args(arguments)} \"\n f\"in {end_time - start_time}ms: {e}\"\n)\n```\n\n**log argument keys only:**\n\n```python\nlogger.info(f\"Calling tool: {name} with argument keys: {list(arguments.keys())}\")\n```\n\n**File logging:** Consider reducing the default log level for the file handler to `WARNING` so that normal-operation INFO records (which include arguments) are not persisted. Sensitive content would only appear in file logs on error.",
"id": "GHSA-7xgw-6qf3-7w59",
"modified": "2026-05-14T18:24:44Z",
"published": "2026-05-14T18:24:44Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/dbt-labs/dbt-mcp/security/advisories/GHSA-7xgw-6qf3-7w59"
},
{
"type": "PACKAGE",
"url": "https://github.com/dbt-labs/dbt-mcp"
},
{
"type": "WEB",
"url": "https://github.com/dbt-labs/dbt-mcp/releases/tag/v1.17.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "dbt MCP Server Logs Tool Arguments Including SQL Queries and Credentials in Plaintext Without Redaction When File Logging Is Enabled"
}
PYSEC-2026-2441
Vulnerability from pysec - Published: 2026-07-13 15:19 - Updated: 2026-07-13 16:03
VLAI
Details
Discovered through manual source code review. Verified by PoC execution against a local dbt-mcp v1.15.1 installation.
Summary
DbtMCP.call_tool() in src/dbt_mcp/mcp/server.py logs the complete raw arguments dictionary at INFO level on every tool invocation (line 67) and again at ERROR level if the call raises an exception (lines 77–79). No field is redacted before logging. When the documented DBT_MCP_SERVER_FILE_LOGGING=true feature is enabled, these log records are written to dbt-mcp.log in the project root directory as plaintext. Sensitive data — raw SQL queries, --vars payloads carrying credentials, node selectors — persists on disk indefinitely with no automatic rotation or deletion.
Details
Vulnerable log statements (server.py):
# Line 67 — emitted before every tool execution
logger.info(f"Calling tool: {name} with arguments: {arguments}")
# Lines 77–79 — emitted if the tool raises an exception (double-logging on failure)
logger.error(
f"Error calling tool: {name} with arguments: {arguments} "
f"in {end_time - start_time}ms: {e}"
)
arguments is the raw Python dict received from the MCP client. It is string-interpolated directly into the log message. On a tool call that raises an exception, the same dict is logged twice — once at INFO and once at ERROR.
File logging is activated by DBT_MCP_SERVER_FILE_LOGGING=true (a documented feature in the project README). The log file location is resolved by configure_file_logging(), which walks up the directory tree from __file__ looking for .git or pyproject.toml, falling back to $HOME. Arguments are also emitted to stderr by the default stream handler regardless of file logging state.
PoC
MCP client script — triggers real tool calls and verifies log file contents:
#!/usr/bin/env python3
# poc4_tool_args_logged.py
# Vulnerable code: src/dbt_mcp/mcp/server.py line 67, 77-79
# configure_file_logging(): src/dbt_mcp/telemetry/logging.py
import logging
from pathlib import Path
LOG_FILENAME = "dbt-mcp.log"
def configure_file_logging(log_level: int = logging.INFO) -> Path:
"""Reproduction of configure_file_logging() from telemetry/logging.py."""
module_path = Path(__file__).resolve().parent
home = Path.home().resolve()
for candidate in [module_path, *module_path.parents]:
if (candidate / ".git").exists() or (candidate / "pyproject.toml").exists() or candidate == home:
repo_root = candidate
break
log_path = repo_root / LOG_FILENAME
root_logger = logging.getLogger()
root_logger.setLevel(log_level)
file_handler = logging.FileHandler(log_path, encoding="utf-8")
file_handler.setLevel(log_level)
file_handler.setFormatter(
logging.Formatter("%(asctime)s %(levelname)s [%(name)s] %(message)s")
)
root_logger.addHandler(file_handler)
return log_path
log_path = configure_file_logging()
server_logger = logging.getLogger("dbt_mcp.mcp.server")
# Exact log statements from server.py line 67 and line 77-79
name = "show"
arguments = {"sql_query": "SELECT ssn, credit_card_number, salary FROM customers WHERE id = 42", "limit": 5}
server_logger.info(f"Calling tool: {name} with arguments: {arguments}")
name2 = "run"
arguments2 = {"node_selection": "sensitive_model", "vars": '{"db_password": "hunter2", "api_key": "sk-prod-abc123xyz"}', "is_full_refresh": False}
server_logger.info(f"Calling tool: {name2} with arguments: {arguments2}")
# Verify file contents
lines = log_path.read_text(encoding="utf-8").splitlines()
poc_lines = [l for l in lines if "dbt_mcp.mcp.server" in l]
print(f"[log file: {log_path}]")
for line in poc_lines:
print(f" {line}")
keywords = ["ssn", "credit_card_number", "salary", "db_password", "api_key"]
found = [kw for kw in keywords if any(kw in l for l in poc_lines)]
if found:
print(f"\n[CONFIRMED] Sensitive keywords in plaintext log: {found}")
print(f"[CONFIRMED] No redaction applied. File persists at {log_path}")
Expected log file entries:
2026-04-27 ... INFO [dbt_mcp.mcp.server] Calling tool: show with arguments:
{'sql_query': 'SELECT ssn, credit_card_number, salary FROM customers', 'limit': 5}
2026-04-27 ... INFO [dbt_mcp.mcp.server] Calling tool: run with arguments:
{'node_selection': 'sensitive_model',
'vars': '{"db_password":"hunter2","api_key":"sk-prod-abc123"}',
'is_full_refresh': False}
[CONFIRMED] Sensitive keywords in plaintext log: ['ssn', 'credit_card_number', 'salary', 'db_password', 'api_key']
[CONFIRMED] No redaction applied.
Impact
Directly proven by this PoC:
- When
DBT_MCP_SERVER_FILE_LOGGING=true, the fullargumentsdict of every tool call — includingsql_query,vars, andnode_selection— is written todbt-mcp.login plaintext on every invocation. - A tool call that raises an exception produces two log entries with the same sensitive content (INFO + ERROR double-logging).
- The log file has no automatic rotation, expiry, or access restriction beyond filesystem permissions.
Combined with Advisory 3 (telemetry), a single show tool call containing PII produces one telemetry transmission to dbt Labs and one (or two, on failure) persistent log entries on disk.
Remediation
redact known-sensitive argument values before logging:
_LOG_REDACT = frozenset({"sql_query", "vars"})
def _safe_args(arguments: dict) -> dict:
return {k: "***redacted***" if k in _LOG_REDACT else v
for k, v in arguments.items()}
# server.py line 67:
logger.info(f"Calling tool: {name} with arguments: {_safe_args(arguments)}")
# server.py lines 77-79:
logger.error(
f"Error calling tool: {name} with arguments: {_safe_args(arguments)} "
f"in {end_time - start_time}ms: {e}"
)
log argument keys only:
logger.info(f"Calling tool: {name} with argument keys: {list(arguments.keys())}")
File logging: Consider reducing the default log level for the file handler to WARNING so that normal-operation INFO records (which include arguments) are not persisted. Sensitive content would only appear in file logs on error.
Severity
Impacted products
| Name | purl | dbt-mcp | pkg:pypi/dbt-mcp |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "dbt-mcp",
"purl": "pkg:pypi/dbt-mcp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.17.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.0.1a1",
"0.1.0",
"0.1.1",
"0.1.2",
"0.1.2rc1",
"0.1.2rc2",
"0.1.3",
"0.10.0",
"0.10.1",
"0.10.2",
"0.10.3",
"0.2.1",
"0.2.10",
"0.2.11",
"0.2.12",
"0.2.13",
"0.2.14",
"0.2.15",
"0.2.16",
"0.2.17",
"0.2.18",
"0.2.19",
"0.2.20",
"0.2.3",
"0.2.4",
"0.2.5",
"0.2.6",
"0.2.7",
"0.2.8",
"0.2.9",
"0.3.0",
"0.4.0",
"0.4.1",
"0.4.2",
"0.5.0",
"0.6.0",
"0.6.1",
"0.7.0",
"0.8.0",
"0.8.1",
"0.8.2",
"0.8.3",
"0.8.4",
"0.9.0",
"0.9.1",
"1.0.0",
"1.1.0",
"1.10.0",
"1.11.0",
"1.12.0",
"1.13.0",
"1.14.0",
"1.15.0",
"1.17.0",
"1.2.0",
"1.3.0",
"1.4.0",
"1.5.0",
"1.5.1",
"1.5.2",
"1.6.0",
"1.6.2",
"1.7.0",
"1.8.0",
"1.8.1",
"1.9.0",
"1.9.1",
"1.9.2",
"1.9.3"
]
}
],
"aliases": [
"CVE-2026-44969",
"GHSA-7xgw-6qf3-7w59"
],
"details": "*Discovered through manual source code review. Verified by PoC execution against a local dbt-mcp v1.15.1 installation.*\n\n### Summary\n\n`DbtMCP.call_tool()` in `src/dbt_mcp/mcp/server.py` logs the complete raw `arguments` dictionary at `INFO` level on every tool invocation (line 67) and again at `ERROR` level if the call raises an exception (lines 77\u201379). No field is redacted before logging. When the documented `DBT_MCP_SERVER_FILE_LOGGING=true` feature is enabled, these log records are written to `dbt-mcp.log` in the project root directory as plaintext. Sensitive data \u2014 raw SQL queries, `--vars` payloads carrying credentials, node selectors \u2014 persists on disk indefinitely with no automatic rotation or deletion.\n\n### Details\n\n**Vulnerable log statements (`server.py`):**\n\n```python\n# Line 67 \u2014 emitted before every tool execution\nlogger.info(f\"Calling tool: {name} with arguments: {arguments}\")\n\n# Lines 77\u201379 \u2014 emitted if the tool raises an exception (double-logging on failure)\nlogger.error(\n f\"Error calling tool: {name} with arguments: {arguments} \"\n f\"in {end_time - start_time}ms: {e}\"\n)\n```\n\n`arguments` is the raw Python dict received from the MCP client. It is string-interpolated directly into the log message. On a tool call that raises an exception, the same dict is logged twice \u2014 once at INFO and once at ERROR.\n\nFile logging is activated by `DBT_MCP_SERVER_FILE_LOGGING=true` (a documented feature in the project README). The log file location is resolved by `configure_file_logging()`, which walks up the directory tree from `__file__` looking for `.git` or `pyproject.toml`, falling back to `$HOME`. Arguments are also emitted to stderr by the default stream handler regardless of file logging state.\n\n### PoC\n\n**MCP client script \u2014 triggers real tool calls and verifies log file contents:**\n\n```python\n#!/usr/bin/env python3\n# poc4_tool_args_logged.py\n# Vulnerable code: src/dbt_mcp/mcp/server.py line 67, 77-79\n# configure_file_logging(): src/dbt_mcp/telemetry/logging.py\n\nimport logging\nfrom pathlib import Path\n\nLOG_FILENAME = \"dbt-mcp.log\"\n\ndef configure_file_logging(log_level: int = logging.INFO) -\u003e Path:\n \"\"\"Reproduction of configure_file_logging() from telemetry/logging.py.\"\"\"\n module_path = Path(__file__).resolve().parent\n home = Path.home().resolve()\n for candidate in [module_path, *module_path.parents]:\n if (candidate / \".git\").exists() or (candidate / \"pyproject.toml\").exists() or candidate == home:\n repo_root = candidate\n break\n log_path = repo_root / LOG_FILENAME\n root_logger = logging.getLogger()\n root_logger.setLevel(log_level)\n file_handler = logging.FileHandler(log_path, encoding=\"utf-8\")\n file_handler.setLevel(log_level)\n file_handler.setFormatter(\n logging.Formatter(\"%(asctime)s %(levelname)s [%(name)s] %(message)s\")\n )\n root_logger.addHandler(file_handler)\n return log_path\n\nlog_path = configure_file_logging()\nserver_logger = logging.getLogger(\"dbt_mcp.mcp.server\")\n\n# Exact log statements from server.py line 67 and line 77-79\nname = \"show\"\narguments = {\"sql_query\": \"SELECT ssn, credit_card_number, salary FROM customers WHERE id = 42\", \"limit\": 5}\nserver_logger.info(f\"Calling tool: {name} with arguments: {arguments}\")\n\nname2 = \"run\"\narguments2 = {\"node_selection\": \"sensitive_model\", \"vars\": \u0027{\"db_password\": \"hunter2\", \"api_key\": \"sk-prod-abc123xyz\"}\u0027, \"is_full_refresh\": False}\nserver_logger.info(f\"Calling tool: {name2} with arguments: {arguments2}\")\n\n# Verify file contents\nlines = log_path.read_text(encoding=\"utf-8\").splitlines()\npoc_lines = [l for l in lines if \"dbt_mcp.mcp.server\" in l]\nprint(f\"[log file: {log_path}]\")\nfor line in poc_lines:\n print(f\" {line}\")\n\nkeywords = [\"ssn\", \"credit_card_number\", \"salary\", \"db_password\", \"api_key\"]\nfound = [kw for kw in keywords if any(kw in l for l in poc_lines)]\nif found:\n print(f\"\\n[CONFIRMED] Sensitive keywords in plaintext log: {found}\")\n print(f\"[CONFIRMED] No redaction applied. File persists at {log_path}\")\n```\n\n**Expected log file entries:**\n\n````\n2026-04-27 ... INFO [dbt_mcp.mcp.server] Calling tool: show with arguments:\n {\u0027sql_query\u0027: \u0027SELECT ssn, credit_card_number, salary FROM customers\u0027, \u0027limit\u0027: 5}\n\n2026-04-27 ... INFO [dbt_mcp.mcp.server] Calling tool: run with arguments:\n {\u0027node_selection\u0027: \u0027sensitive_model\u0027,\n \u0027vars\u0027: \u0027{\"db_password\":\"hunter2\",\"api_key\":\"sk-prod-abc123\"}\u0027,\n \u0027is_full_refresh\u0027: False}\n\n[CONFIRMED] Sensitive keywords in plaintext log: [\u0027ssn\u0027, \u0027credit_card_number\u0027, \u0027salary\u0027, \u0027db_password\u0027, \u0027api_key\u0027]\n[CONFIRMED] No redaction applied.\n````\n\n\u003cimg width=\"3798\" height=\"462\" alt=\"image\" src=\"https://github.com/user-attachments/assets/b4c23a93-b3d3-4b7f-ba46-3d4a324d609f\" /\u003e\n\n### Impact\n\n**Directly proven by this PoC:**\n\n- When `DBT_MCP_SERVER_FILE_LOGGING=true`, the full `arguments` dict of every tool call \u2014 including `sql_query`, `vars`, and `node_selection` \u2014 is written to `dbt-mcp.log` in plaintext on every invocation.\n- A tool call that raises an exception produces **two** log entries with the same sensitive content (INFO + ERROR double-logging).\n- The log file has no automatic rotation, expiry, or access restriction beyond filesystem permissions.\n\nCombined with Advisory 3 (telemetry), a single `show` tool call containing PII produces one telemetry transmission to dbt Labs **and** one (or two, on failure) persistent log entries on disk.\n\n### Remediation\n\n**redact known-sensitive argument values before logging:**\n\n```python\n_LOG_REDACT = frozenset({\"sql_query\", \"vars\"})\n\ndef _safe_args(arguments: dict) -\u003e dict:\n return {k: \"***redacted***\" if k in _LOG_REDACT else v\n for k, v in arguments.items()}\n\n# server.py line 67:\nlogger.info(f\"Calling tool: {name} with arguments: {_safe_args(arguments)}\")\n\n# server.py lines 77-79:\nlogger.error(\n f\"Error calling tool: {name} with arguments: {_safe_args(arguments)} \"\n f\"in {end_time - start_time}ms: {e}\"\n)\n```\n\n**log argument keys only:**\n\n```python\nlogger.info(f\"Calling tool: {name} with argument keys: {list(arguments.keys())}\")\n```\n\n**File logging:** Consider reducing the default log level for the file handler to `WARNING` so that normal-operation INFO records (which include arguments) are not persisted. Sensitive content would only appear in file logs on error.",
"id": "PYSEC-2026-2441",
"modified": "2026-07-13T16:03:51.063450Z",
"published": "2026-07-13T15:19:05.570555Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/dbt-labs/dbt-mcp/security/advisories/GHSA-7xgw-6qf3-7w59"
},
{
"type": "PACKAGE",
"url": "https://github.com/dbt-labs/dbt-mcp"
},
{
"type": "WEB",
"url": "https://github.com/dbt-labs/dbt-mcp/releases/tag/v1.17.1"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/dbt-mcp"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-7xgw-6qf3-7w59"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44969"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "dbt MCP Server Logs Tool Arguments Including SQL Queries and Credentials in Plaintext Without Redaction When File Logging Is Enabled"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…