CVE-2026-100406

🗓️ 14 Oct 2026 18:27:24Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 26 Views🌐 WEB

Unauthenticated arbitrary SQL execution in dbt docs serve via the /api/v1/query endpoint.

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2026-100406	14 Oct 202623:35	–	circl
Cvelist	CVE-2026-100406 dbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve`	14 Oct 202618:27	–	cvelist
EUVD	EUVD-2026-101600	14 Oct 202618:27	–	euvd
Mend	CVE-2026-100406	14 Oct 202618:27	–	mend
NVD	CVE-2026-100406	14 Oct 202619:16	–	nvd
osv_cve	CVE-2026-100406 dbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve`	14 Oct 202618:27	–	osv_cve
Positive Technologies	PT-2026-102889	29 Sep 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-100406: Improper Limitation of a Pathname to a Restricted Directory	14 Oct 202600:00	–	rapid7
Vulnrichment	CVE-2026-100406 dbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve`	14 Oct 202618:27	–	vulnrichment

Vulners

Node

getdbt dbt_coreRange2.0.0-alpha.0–2.0.0-alpha.5

[
  {
    "vendor": "dbt-labs",
    "product": "dbt-core",
    "versions": [
      {
        "version": ">= 2.0.0-alpha.0, < 2.0.0-alpha.5",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/dbt-labs/dbt/releases/tag/v2.0.0-alpha.5
github	www.github.com/dbt-labs/dbt/commit/3a5d26fe02b58382720d04cbd87143b7b6775413
github	www.github.com/dbt-labs/dbt/security/advisories/GHSA-h2j2-2r7g-rff8

Parameter	Position	Path	Description	CWE
SQL query	request body	/api/v1/query	The unauthenticated /api/v1/query endpoint allows callers to execute arbitrary SQL queries against the DuckDB backend. This can be used to perform filesystem-reading functions to access files outside the intended directory.	CWE-200, CWE-22, CWE-306

20 Oct 2026 02:17Current

6Medium risk

Vulners AI Score6

CVSS 48.2

EPSS0.00423

SSVC

dbt dbt docs serve arbitrary SQL execution unauthenticated /api/v1/query DuckDbViewsBackend::query_arrow()