CyberRota Analysis
AI-GeneratedThe dbt-mcp Model Context Protocol server prior to version 1.17.1 is vulnerable due to improper handling of telemetry data, which exposes sensitive information such as SQL queries and variable data in logs without redaction. This could lead to unintentional data leakage, potentially compromising user privacy and security. Organizations using dbt-mcp should prioritize upgrading to version 1.17.1 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DefaultUsageTracker.emit_tool_called_event() in src/dbt_mcp/tracking/tracking.py serialized every MCP tool call's complete arguments dictionary and sent it through dbtlabs_vortex.producer.log_proto without redaction, including sql_query from show, vars from run, build, and test, and node_selection from compile, while usage_tracking_enabled in settings.py enabled telemetry by default unless DBT_SEND_ANONYMOUS_USAGE_STATS=false or DO_NOT_TRACK=1 was set. This issue is fixed in version 1.17.1.
Related CVEs
Other vulnerabilities affecting the same vendor(s)