PyPI/dbt-mcp CVE-2026-44969: low 2.5, EPSS 0.17%

dbt MCP Server Logs Tool Arguments Including SQL Queries and Credentials in Plaintext Without Redaction When File Logging Is Enabled

Action: Upgrade dbt-mcp to 1.17.1 or later.

pip install dbt-mcp==1.17.1

Affected

Fixed versions

Sources

• osv: PYSEC-2026-2441
• https://github.com/dbt-labs/dbt-mcp/security/advisories/GHSA-7xgw-6qf3-7w59
• https://github.com/dbt-labs/dbt-mcp
• https://github.com/dbt-labs/dbt-mcp/releases/tag/v1.17.1
• https://pypi.org/project/dbt-mcp
• https://github.com/advisories/GHSA-7xgw-6qf3-7w59
• https://nvd.nist.gov/vuln/detail/CVE-2026-44969

CVE-2026-44969 · published 2026-07-13T15:19:05.570555Z · modified 2026-07-13T16:31:43.486184640Z · JSON