gha-lab-4a8fad8536

Автоматизированный исследовательский артефакт — не вышестоящий проект. Этот репозиторий — одноразовая лаборатория, созданная автоматизированным конвейером для магистерской диссертации в Université Laval по воспроизведению опубликованных уязвимостей в рабочих процессах GitHub Actions. Это точный...

CVE-2026-55837

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.20.0, the local OAuth helper in src/dbtmcp/oauth/fastapiapp.py exposes GET /dbtplatformcontext without authentication or Host validation after a user completes the dbt Platform OAuth flow. The endpoint returns the ful...

EUVD-2026-77639

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.20.0, the local OAuth helper in src/dbtmcp/oauth/fastapiapp.py exposes GET /dbtplatformcontext without authentication or Host validation after a user completes the dbt Platform OAuth flow. The endpoint returns the ful...

CVE-2026-55837 dbt-mcp: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.20.0, the local OAuth helper in src/dbtmcp/oauth/fastapiapp.py exposes GET /dbtplatformcontext without authentication or Host validation after a user completes the dbt Platform OAuth flow. The endpoint returns the ful...

CVE-2026-55837 dbt-mcp: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.20.0, the local OAuth helper in src/dbtmcp/oauth/fastapiapp.py exposes GET /dbtplatformcontext without authentication or Host validation after a user completes the dbt Platform OAuth flow. The endpoint returns the ful...

CVE-2026-55837 dbt-mcp: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.20.0, the local OAuth helper in src/dbtmcp/oauth/fastapiapp.py exposes GET /dbtplatformcontext without authentication or Host validation after a user completes the dbt Platform OAuth flow. The endpoint returns the ful...

CVE-2026-55837

dbt-mcp (a Model Context Protocol server for dbt) versions prior to 1.20.0 expose an unauthenticated GET /dbt_platform_context endpoint on their local OAuth helper FastAPI server (bound to 127.0.0.1:6785). The endpoint returns the full DbtPlatformContext object—including the victim's access_token...

CVE-2026-55837: Exposure of Sensitive Information to an Unauthorized Actor

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.20.0, the local OAuth helper in src/dbtmcp/oauth/fastapiapp.py exposes GET /dbtplatformcontext without authentication or Host validation after a user completes the dbt Platform OAuth flow. The endpoint returns the ful...

Malicious code in dbt-sa-cli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a3fc52d1baa65bd51dd9659641f0df237ea2a595358cd91b19fd8988ba3236a setup.py defines rcepoc and invokes it at module top level, so the code runs unconditionally during pip install dbt-sa-cli. The function collects...

MAL-2026-15934 Malicious code in dbt-sa-cli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a3fc52d1baa65bd51dd9659641f0df237ea2a595358cd91b19fd8988ba3236a setup.py defines rcepoc and invokes it at module top level, so the code runs unconditionally during pip install dbt-sa-cli. The function collects...

GHSA-CFQR-CJX5-5JCM vulnerabilities

Vulnerabilities for packages: mlflow, dbt-bigquery, dbt-core...

CVE-2026-84305 vulnerabilities

Vulnerabilities for packages: mlflow, dbt-bigquery, dbt-core...

CVE-2026-49360 Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB

Recce is a data-validation toolkit for enhanced dbt data build tool PR review. Prior to version 1.50.0, OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured...

CVE-2026-44969

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DbtMCP.calltool in src/dbtmcp/mcp/server.py logged the raw arguments dictionary at INFO level before each tool call and at ERROR level on exceptions, and configurefilelogging wrote those records to dbt-mcp.log...

CVE-2026-44970

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DefaultUsageTracker.emittoolcalledevent in src/dbtmcp/tracking/tracking.py serialized every MCP tool call's complete arguments dictionary and sent it through dbtlabsvortex.producer.logproto without redaction,...

CVE-2026-44968

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, rundbtcommand in src/dbtmcp/dbtcli/tools.py appended unsanitized nodeselection and resourcetype values to the dbt subprocess argument list, allowing an MCP client to inject dbt global flags such as --profiles-di...

CVE-2026-44969

dbt-mcp: CVE-2026-44969 involves logging of complete tool call arguments (including sql_query, vars, and node_selection) in plaintext when DBT_MCP_SERVER_FILE_LOGGING is enabled. The issue is present in earlier versions (e.g., v1.15.x) and fixed in v1.17.1. Connected sources confirm that argument...

CVE-2026-44969

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DbtMCP.calltool in src/dbtmcp/mcp/server.py logged the raw arguments dictionary at INFO level before each tool call and at ERROR level on exceptions, and configurefilelogging wrote those records to dbt-mcp.log...

CVE-2026-44969 dbt-mcp: Tool Arguments Including SQL Queries and Credentials Logged in Plaintext Without Redaction When File Logging Is Enabled

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DbtMCP.calltool in src/dbtmcp/mcp/server.py logged the raw arguments dictionary at INFO level before each tool call and at ERROR level on exceptions, and configurefilelogging wrote those records to dbt-mcp.log...

EUVD-2026-44993

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DbtMCP.calltool in src/dbtmcp/mcp/server.py logged the raw arguments dictionary at INFO level before each tool call and at ERROR level on exceptions, and configurefilelogging wrote those records to dbt-mcp.log...