CVE-2026-44969

Katalog CVE

CVSS 3.3 · Low EPSS 0,17%

Kerentanan Insertion of Sensitive Information into Log File pada getdbt dbt mcp server. Skor CVSS 3.1 3.3 (Low) menurut NVD.

Deskripsi (NVD)

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DbtMCP.call_tool() in src/dbt_mcp/mcp/server.py logged the raw arguments dictionary at INFO level before each tool call and at ERROR level on exceptions, and configure_file_logging() wrote those records to dbt-mcp.log when DBT_MCP_SERVER_FILE_LOGGING=true, preserving sensitive sql_query, vars, and node_selection values in plaintext without automatic rotation or deletion. This issue is fixed in version 1.17.1.

Rincian

Terbit di NVD

16 Juli 2026

Terakhir diubah

21 Juli 2026

Status NVD

Analyzed

CVSS 3.1

3.3 (Low), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-532: Insertion of Sensitive Information into Log File

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 5,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/dbt-labs/dbt-mcp/security/advisories/GHSA-7xgw-6qf3-7w59 exploit · mitigasi · advisory vendor
• https://github.com/dbt-labs/dbt-mcp/commit/6534507b5e7a729758d5baece155602cad0bb22f patch
• https://github.com/dbt-labs/dbt-mcp/pull/752 issue tracking · patch
• https://github.com/dbt-labs/dbt-mcp/releases/tag/v1.17.1 release notes