Lucene search
+L

16 matches found

Github Security Blog
Github Security Blog
added 2026/05/14 6:25 p.m.20 views

dbt MCP Server Transmits All MCP Tool Arguments Including Raw SQL and --vars Credentials to dbt Labs Telemetry by Default Without Redaction

Discovered through manual source code review. Verified by PoC execution against a local dbt-mcp v1.15.1 installation. Summary DefaultUsageTracker.emittoolcalledevent in src/dbtmcp/tracking/tracking.py serializes the complete arguments dictionary of every MCP tool call and transmits it verbatim to...

4.3CVSS6AI score0.00217EPSS
SaveExploits1References3Affected Software1
Rows per page
Query Builder