dbt-labs dbt-mcp up to 1.17.0 Usage Tracker tracking.py DefaultUsageTracker.emit_tool_called_event sql_query/vars/build/test/node_selection deserialization

Summaryinfo

A vulnerability was found in dbt-labs dbt-mcp up to 1.17.0. It has been rated as problematic. This issue affects the function DefaultUsageTracker.emit_tool_called_event of the file src/dbt_mcp/tracking/tracking.py of the component Usage Tracker. This manipulation of the argument sql_query/vars/build/test/node_selection causes deserialization. This vulnerability appears as CVE-2026-44970. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as problematic was found in dbt-labs dbt-mcp up to 1.17.0. Affected by this vulnerability is the function DefaultUsageTracker.emit_tool_called_event of the file src/dbt_mcp/tracking/tracking.py of the component Usage Tracker. The manipulation of the argument sql_query/vars/build/test/node_selection with an unknown input leads to a deserialization vulnerability. The CWE definition for the vulnerability is CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. As an impact it is known to affect confidentiality. The summary by CVE is:

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DefaultUsageTracker.emit_tool_called_event() in src/dbt_mcp/tracking/tracking.py serialized every MCP tool call's complete arguments dictionary and sent it through dbtlabs_vortex.producer.log_proto without redaction, including sql_query from show, vars from run, build, and test, and node_selection from compile, while usage_tracking_enabled in settings.py enabled telemetry by default unless DBT_SEND_ANONYMOUS_USAGE_STATS=false or DO_NOT_TRACK=1 was set. This issue is fixed in version 1.17.1.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-44970 since 05/08/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.17.1 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Artificial Intelligence Software

Vendor

• dbt-labs

Name

• dbt-mcp

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17.0

Website

• Product: https://github.com/dbt-labs/dbt-mcp/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion