Lucene search
+L

1 matches found

PyPA
PyPA
added 2026/07/13 3:19 p.m.34 views

dbt MCP Server Transmits All MCP Tool Arguments Including Raw SQL and --vars Credentials to dbt Labs Telemetry by Default Without Redaction

Discovered through manual source code review. Verified by PoC execution against a local dbt-mcp v1.15.1 installation. SummaryDefaultUsageTracker.emittoolcalledevent in src/dbtmcp/tracking/tracking.py serializes the complete arguments dictionary of every MCP tool call and transmits it verbatim to...

3.1CVSS6.2AI score0.00373EPSS
SaveExploits1References6Affected Software1
Rows per page
Query Builder