CVE-2026-100406

The dbt tool (versions 2.0.0-alpha.0 through 2.0.0-alpha.4 ) contains a vulnerability where the dbt docs serve command exposes an unauthenticated POST /api/v1/query endpoint. The root cause is that the crates/dbt-docs-server/src/handlers/query.rs handler passes caller-supplied SQL directly to Duc...