CyberRota Analysis
AI-GeneratedThe dbt-mcp server prior to version 1.17.1 is vulnerable due to improper logging practices, which expose sensitive information such as SQL queries and variables in plaintext within the log files. This could lead to unauthorized access to sensitive data if the logs are not adequately secured. Organizations using dbt-mcp should prioritize upgrading to version 1.17.1 to mitigate the risk of data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DbtMCP.call_tool() in src/dbt_mcp/mcp/server.py logged the raw arguments dictionary at INFO level before each tool call and at ERROR level on exceptions, and configure_file_logging() wrote those records to dbt-mcp.log when DBT_MCP_SERVER_FILE_LOGGING=true, preserving sensitive sql_query, vars, and node_selection values in plaintext without automatic rotation or deletion. This issue is fixed in version 1.17.1.
Related CVEs
Other vulnerabilities affecting the same vendor(s)