SEPTEMBER 8, 2026
Live Feed
Back to database
Case File

CVE-2026-44970

LOW · CVSS 3.1 EPSS 0.24% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-16 · Last synced 2026-08-15

CyberRota Analysis

AI-Generated

The dbt-mcp Model Context Protocol server prior to version 1.17.1 is vulnerable due to improper handling of telemetry data, which exposes sensitive information such as SQL queries and variable data in logs without redaction. This could lead to unintentional data leakage, potentially compromising user privacy and security. Organizations using dbt-mcp should prioritize upgrading to version 1.17.1 to mitigate these risks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-44970
Severity
LOW
CVSS
3.1
EPSS
0.24%

Original NVD Description

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DefaultUsageTracker.emit_tool_called_event() in src/dbt_mcp/tracking/tracking.py serialized every MCP tool call's complete arguments dictionary and sent it through dbtlabs_vortex.producer.log_proto without redaction, including sql_query from show, vars from run, build, and test, and node_selection from compile, while usage_tracking_enabled in settings.py enabled telemetry by default unless DBT_SEND_ANONYMOUS_USAGE_STATS=false or DO_NOT_TRACK=1 was set. This issue is fixed in version 1.17.1.

Related CVEs

Other vulnerabilities affecting the same vendor(s)