CVE-2026-55837— dbt-mcp: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens
Quick assessment
Affected
dbt-labs dbt-mcp
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
dbt-mcp 是一个用于与 dbt 交互的模型上下文协议（MCP）服务器。在 1.20.0 版本之前，位于 中的本地 OAuth 辅助模块在未进行身份验证或 Host 头部验证的情况下，暴露了 端点（在用户完成 dbt Platform OAuth 流程后）。该端点会向任何能够访问 的进程返回完整的 ，其中包含由上下文管理器持久化存储的 和 值。 由于缺少 ，远程攻击者可以利用 DNS 重绑定（DNS rebinding）针对受害者的浏览器发起攻击，因为该辅助模块接受任意的 Host 头；同时，同一主机上的其他进
Possible ATT&CK Techniques 1 AI
T1040 · Network Sniffing
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-55837
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
dbt-mcp: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens
Source: CVE Program / CVE List V5
Vulnerability Description
dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.20.0, the local OAuth helper in src/dbt_mcp/oauth/fastapi_app.py exposes GET /dbt_platform_context without authentication or Host validation after a user completes the dbt Platform OAuth flow. The endpoint returns the full DbtPlatformContext, including access_token and refresh_token values persisted by the context manager, to any process that can reach 127.0.0.1:6785. The absence of TrustedHostMiddleware allows a remote attacker to use DNS rebinding against a victim's browser because the helper accepts arbitrary Host headers, while a co-located process can request the endpoint directly. The stolen tokens provide immediate dbt Platform API access as the victim and persistent access through the refresh token, allowing access to or modification of projects, jobs, environment secrets, and related account data. This issue is fixed in version 1.20.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-55837
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55837
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-55837 (1)
Vendor Advisories for CVE-2026-55837 (1)
Vendor Pages for CVE-2026-55837 (1)
-
🔗 Release v1.20.0 · dbt-labs/dbt-mcp · GitHub x_refsource_MISC
Other References for CVE-2026-55837 (1)
IV. Related Vulnerabilities
Same vendor: dbt-labs
-
CVE-2026-44969
dbt-mcp: Tool Arguments Including SQL Queries and Credential -
CVE-2026-44970
dbt-mcp: All MCP Tool Arguments Including Raw SQL and --vars -
CVE-2026-44968
dbt-mcp: Argument Injection in dbt CLI Tool Wrappers via nod -
CVE-2026-39382
dbt has a Command Injection in Reusable Workflow via Unsanit -
CVE-2026-29790
dbt-common: commonprefix() doesn't protect against path trav
Same weakness: CWE-200
-
CVE-2026-90811
cosmicstack-labs mercury-agent Shell Permission Manifest per -
CVE-2026-47701
OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads -
CVE-2026-73178
Apache Syncope: JWT Access Token takeover -
CVE-2026-90936
Froxlor before 2.3.7 Information Disclosure via customer_ema -
CVE-2026-85188
Joomla Extension - regularlabs.com - Database data disclosur
V. Comments for CVE-2026-55837
No comments yet