gha-lab-4a8fad8536

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of dbt-labs/actions at commit...

CVE-2026-100406

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src/handlers/query.r...

CVE-2026-100406 dbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve`

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src/handlers/query.r...

CVE-2026-100406

The dbt tool (versions 2.0.0-alpha.0 through 2.0.0-alpha.4 ) contains a vulnerability where the dbt docs serve command exposes an unauthenticated POST /api/v1/query endpoint. The root cause is that the crates/dbt-docs-server/src/handlers/query.rs handler passes caller-supplied SQL directly to Duc...

CVE-2026-100406 dbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve`

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src/handlers/query.r...

CVE-2026-100406: Improper Limitation of a Pathname to a Restricted Directory

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src/handlers/query.r...

dbt-snowflake (1.4.0b1) potentially affected by CVE-2026-86597 via snowflake-connector-python (2.8.3)

snowflake-connector-python PYPI version 2.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dbt-snowflake 1.4.0b1 Source cves: CVE-2026-86597 Source advisory: OSV:GHSA-QQJ6-54Q6-CXV6...

dbnd-snowflake (>=0.48.0, <=1.0.4.22), dbt (>=0.21.0b1, <=0.21.1) +7 more potentially affected by CVE-2026-86597 via snowflake-connector-python (2.5.1)

snowflake-connector-python PYPI version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dbnd-snowflake =0.48.0, =0.21.0b1, =0.21.0a17, =0.4.1, =0.21.0b1, =0.1.0, =0.1.1, =0.0.1, =0.3.0, =0.4.0...

csv-to-snowflake (>=0.1.0, <=0.2.1), dbt (>=0.18.0rc1, <=0.19.0b1) +1 more potentially affected by CVE-2026-86597 via snowflake-connector-python (2.2.10)

snowflake-connector-python PYPI version 2.2.10 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - csv-to-snowflake =0.1.0, =0.18.0rc1, =0.2.3, =0.3.0 Source cves: CVE-2026-86597 Source advisory:...

dbt-gen (>=0.1.1, <=0.1.4) potentially affected by CVE-2026-86597 via snowflake-connector-python (2.7.4)

snowflake-connector-python PYPI version 2.7.4 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dbt-gen =0.1.1, =0.1.4 Source cves: CVE-2026-86597 Source advisory: OSV:GHSA-QQJ6-54Q6-CXV6...

dbt (>=0.15.3rc1, <=0.16.0b1), dbt-snowflake (>=0.15.3rc1, <=0.16.0b1) +1 more potentially affected by CVE-2026-86597 via snowflake-connector-python (2.0.4)

snowflake-connector-python PYPI version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dbt =0.15.3rc1, =0.15.3rc1, =1.0.5, =1.1.0 Source cves: CVE-2026-86597 Source advisory: OSV:GHSA-QQJ6-54Q6-C...

cloeextensions (>=20230717.1.0, <=20231120.1.0), dbt-snowflake (>=1.4.0rc1, <=1.5.0b2) +1 more potentially affected by CVE-2026-86597 via snowflake-connector-python (2.8.1)

snowflake-connector-python PYPI version 2.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - cloeextensions =20230717.1.0, =1.4.0rc1, =1.5.0b2 - odd-dbt 0.1.7 Source cves: CVE-2026-86597 Source advisor...

dbt-schema-builder (>=0.4.3, <=0.4.4), dbt-snowflake (>=1.0.0rc1, <=1.0.1) +2 more potentially affected by CVE-2026-86597 via snowflake-connector-python (2.7.10)

snowflake-connector-python PYPI version 2.7.10 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dbt-schema-builder =0.4.3, =1.0.0rc1, =0.1.1, =0.2.7 - elementary-lineage 0.1.0 Source cves: CVE-2026-86597...

dbt (>=0.16.0b2, <=0.18.0b2), dbt-schema-builder (>=0.1.0, <=0.2.2) +3 more potentially affected by CVE-2026-86597 via snowflake-connector-python (2.2.1)

snowflake-connector-python PYPI version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dbt =0.16.0b2, =0.1.0, =0.16.0b2, =0.2.0, =0.2.5 - snowshu 0.0.1b3 Source cves: CVE-2026-86597 Source...

arreyy (0.0.1), dbt-schema-builder (>=0.4.5, <=0.4.13) +6 more potentially affected by CVE-2026-86597 via snowflake-connector-python (2.7.12)

snowflake-connector-python PYPI version 2.7.12 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - arreyy 0.0.1 - dbt-schema-builder =0.4.5, =1.1.0b1, =0.0.1, =0.0.1, =1.15.0, =2.2.0 - pyexql 0.0.1 Source...

PT-2026-102889

Name of the Vulnerable Software and Affected Versions dbt versions 2.0.0-alpha.0 through 2.0.0-alpha.4 Description dbt docs serve exposes an unauthenticated POST '/api/v1/query' endpoint. This endpoint passes caller-supplied SQL to the DuckDbViewsBackend::query arrow function without authorizatio...

acryl-datahub-airflow-plugin (>=0.8.44.4rc1, <=0.9.2.1), airflow-add-ons (0.2.9b2) +8 more potentially affected by CVE-2026-75158 via apache-airflow (2.2.5)

apache-airflow PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - acryl-datahub-airflow-plugin =0.8.44.4rc1, =0.8.0, =0.2.0, =0.0.3, =0.0.6, =0.0.1, =0.5.2, =0.8.3a1, =0.2.35, =0.2.37 Source cves:...

CVE-2026-55837

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.20.0, the local OAuth helper in src/dbtmcp/oauth/fastapiapp.py exposes GET /dbtplatformcontext without authentication or Host validation after a user completes the dbt Platform OAuth flow. The endpoint returns the ful...

CVE-2026-55837 dbt-mcp: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.20.0, the local OAuth helper in src/dbtmcp/oauth/fastapiapp.py exposes GET /dbtplatformcontext without authentication or Host validation after a user completes the dbt Platform OAuth flow. The endpoint returns the ful...

CVE-2026-55837 dbt-mcp: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.20.0, the local OAuth helper in src/dbtmcp/oauth/fastapiapp.py exposes GET /dbtplatformcontext without authentication or Host validation after a user completes the dbt Platform OAuth flow. The endpoint returns the ful...