CVE-2026-44970

Katalog CVE

CVSS 4.3 · Medium EPSS 0,37%

Kerentanan Insertion of Sensitive Information Into Sent Data pada getdbt dbt mcp server. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DefaultUsageTracker.emit_tool_called_event() in src/dbt_mcp/tracking/tracking.py serialized every MCP tool call's complete arguments dictionary and sent it through dbtlabs_vortex.producer.log_proto without redaction, including sql_query from show, vars from run, build, and test, and node_selection from compile, while usage_tracking_enabled in settings.py enabled telemetry by default unless DBT_SEND_ANONYMOUS_USAGE_STATS=false or DO_NOT_TRACK=1 was set. This issue is fixed in version 1.17.1.

Rincian

Terbit di NVD

16 Juli 2026

Terakhir diubah

21 Juli 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-201: Insertion of Sensitive Information Into Sent Data

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 29,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/dbt-labs/dbt-mcp/security/advisories/GHSA-jj54-r8gm-2fcf exploit · mitigasi · advisory vendor
• https://github.com/dbt-labs/dbt-mcp/commit/6534507b5e7a729758d5baece155602cad0bb22f patch
• https://github.com/dbt-labs/dbt-mcp/pull/752 issue tracking · patch
• https://github.com/dbt-labs/dbt-mcp/releases/tag/v1.17.1 release notes