PyPI/dbt-mcp CVE-2026-44969: low 2.5, EPSS 0.17%

dbt MCP Server Logs Tool Arguments Including SQL Queries and Credentials in Plaintext Without Redaction When File Logging Is Enabled

Action: Upgrade dbt-mcp to 1.17.1 or later.

pip install dbt-mcp==1.17.1

Affected

Fixed versions

Sources

• osv: GHSA-7xgw-6qf3-7w59
• https://github.com/dbt-labs/dbt-mcp/security/advisories/GHSA-7xgw-6qf3-7w59
• https://github.com/dbt-labs/dbt-mcp
• https://github.com/dbt-labs/dbt-mcp/releases/tag/v1.17.1

CVE-2026-44969 · published 2026-05-14T18:24:44Z · modified 2026-07-13T16:42:44.587829084Z · JSON