Vulnerabilities in dbt-labs

9 results

CVE-2024-36105MEDIUMdbt allows Binding to an Unrestricted IP Address via socketsocketEPSS 0.7%CVE-2026-100406HIGHdbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve`EPSS 0.4%CVE-2026-39382CRITICALdbt has a Command Injection in Reusable Workflow via Unsanitized comment-body OutputEPSS 0.4%CVE-2024-40637MEDIUMImplicit override for built-in materializations from installed packages in dbt-coreEPSS 0.4%CVE-2026-44970LOWdbt-mcp: All MCP Tool Arguments Including Raw SQL and --vars Credentials Transmitted to dbt Labs Telemetry by Default Without RedactionEPSS 0.4%CVE-2026-29790LOWdbt-common: commonprefix() doesn't protect against path traversalEPSS 0.3%CVE-2026-55837MEDIUMdbt-mcp: Unauthenticated OAuth Context Endpoint Leaks dbt Platform TokensEPSS 0.3%CVE-2026-44968MEDIUMdbt-mcp: Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type ParametersEPSS 0.2%CVE-2026-44969LOWdbt-mcp: Tool Arguments Including SQL Queries and Credentials Logged in Plaintext Without Redaction When File Logging Is EnabledEPSS 0.2%