PyPI/dbt-mcp CVE-2026-44970: low 3.1, EPSS 0.37%

dbt MCP Server Transmits All MCP Tool Arguments Including Raw SQL and --vars Credentials to dbt Labs Telemetry by Default Without Redaction

Action: Upgrade dbt-mcp to 1.17.1 or later.

pip install dbt-mcp==1.17.1

Affected

Fixed versions

Sources

• osv: GHSA-jj54-r8gm-2fcf
• https://github.com/dbt-labs/dbt-mcp/security/advisories/GHSA-jj54-r8gm-2fcf
• https://github.com/dbt-labs/dbt-mcp
• https://github.com/dbt-labs/dbt-mcp/releases/tag/v1.17.1

CVE-2026-44970 · published 2026-05-14T18:25:13Z · modified 2026-07-13T16:42:36.080807798Z · JSON