PT-2026-102889

Found a High issue in dbt Core v2 alphas - CVE-2026-100406. : dbt docs serve had an open query endpoint with no login. If that server was reachable, local files like creds and keys could leak. Fixed in 2.0.0-alpha.5. Upgrade and keep docs serve local. https://t.co/o5ISFpV6cb...

CVE-2026-84305 vulnerabilities

Vulnerabilities for packages: mlflow, dbt-core, dbt-bigquery...

GHSA-CFQR-CJX5-5JCM vulnerabilities

Vulnerabilities for packages: mlflow, dbt-core, dbt-bigquery...

dbt-common's commonprefix() doesn't protect against path traversal

ImpactWhat kind of vulnerability is it? Who is impacted?A path traversal vulnerability exists in dbt-common's safeextract function used when extracting tarball archives. The function uses os.path.commonprefix to validate that extracted files remain within the intended destination directory...

GHSA-6V7P-G79W-8964 vulnerabilities

Vulnerabilities for packages: dask-kubernetes, openstack-glance-2025.2, mitmproxy, openstack-kolla-toolbox-2025.1-fips, openstack-kolla-toolbox-2025.2, openstack-placement-2026.1, dbt-snowflake, openstack-kolla-toolbox-2026.1, nvidia-nsight-compute-13.3, graalvm, openstack-placement-2025.1-fips,...

GHSA-7GCM-G887-7QV7 vulnerabilities

Vulnerabilities for packages: mitmproxy, pgadmin4-fips, dbt-snowflake, authentik-fips, barman, kserve, pgadmin4, airflow, datadog-agent, azure-functions-python-worker, apache-beam-python-3.11-sdk, kubeflow-pipelines, label-studio, semgrep, tensorflow-gpu-jupyter,...

CVE-2026-0994 vulnerabilities

Vulnerabilities for packages: mitmproxy, pgadmin4-fips, dbt-snowflake, authentik-fips, barman, kserve, pgadmin4, airflow, datadog-agent, azure-functions-python-worker, apache-beam-python-3.11-sdk, kubeflow-pipelines, label-studio, semgrep, tensorflow-gpu-jupyter,...

CVE-2024-40637 Implicit override for built-in materializations from installed packages in dbt-core

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user installs a package in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by design, as it...

CVE-2024-40637 Implicit override for built-in materializations from installed packages in dbt-core

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user installs a package in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by design, as it...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview dbt-core is a With dbt, data analysts and engineers can build analytics the way engineers build applications. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' allowing an attacker to insta...

Binding To An Unrestricted IP Address

dbt-core is vulnerable to Binding to an Unrestricted IP Address. The vulnerability is due to the binding of INADDRANY or IN6ADDRANY to any network interface on the local system not just localhost, which exposes the application on all network interfaces. An attacker can gain unauthorized access by...

CVE-2024-36105 dbt allows Binding to an Unrestricted IP Address via socketsocket

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Prior to versions 1.6.15, 1.7.15, and 1.8.1, Binding to INADDRANY 0.0.0.0 or IN6ADDRANY :: exposes an application on all network interfaces, increasing the...

CVE-2024-36105

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Prior to versions 1.6.15, 1.7.15, and 1.8.1, Binding to "INADDRANY 0.0.0.0" or "IN6ADDRANY ::" exposes an application on all network interfaces, increasing t...

CVE-2024-36105

CVE-2024-36105 affects dbt-core prior to 1.6.15, 1.7.15, and 1.8.1. The issue arises when the docs server binds to INADDR_ANY or IN6ADDR_ANY (0.0.0.0/::) instead of localhost, exposing the HTTP server on all network interfaces. This can enable unauthorized access from other hosts on the same netw...

PT-2024-26893

Name of the Vulnerable Software and Affected Versions dbt-core versions prior to 1.6.15 dbt-core versions prior to 1.7.15 dbt-core versions prior to 1.8.1 Description The issue arises from binding to INADDR ANY 0.0.0.0 or IN6ADDR ANY ::, which exposes the application on all network interfaces,...

CVE-2024-36105: Binding to an Unrestricted IP Address

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Prior to versions 1.6.15, 1.7.15, and 1.8.1, Binding to INADDRANY 0.0.0.0 or IN6ADDRANY :: exposes an application on all network interfaces, increasing the...

GHSA-P72Q-H37J-3HQ7 dbt uses a SQLparse version with a high vulnerability

Summary Using a version of sqlparse that has a security vulnerability and no way to update in current version of dbt core. Snyk recommends using sqlparse==0.5 but this causes a conflict with dbt. Snyk states the issues is a recursion error: SNYK-PYTHON-SQLPARSE-6615674. Details Dependency conflic...

dbt uses a SQLparse version with a high vulnerability

Summary Using a version of sqlparse that has a security vulnerability and no way to update in current version of dbt core. Snyk recommends using sqlparse==0.5 but this causes a conflict with dbt. Snyk states the issues is a recursion error: SNYK-PYTHON-SQLPARSE-6615674. Details Dependency conflic...

PT-2024-40393 · Dbt-Core +1 · Dbt-Core +1

Name of the Vulnerable Software and Affected Versions: dbt-core versions 1.6.0 through 1.6.12 dbt-core versions 1.7.0 through 1.7.12 Description: The issue is related to a recursion error in the sqlparse library used by dbt-core. This error can be triggered by parsing a specific SQL query, such a...

GHSA-J4G3-3Q8X-JXQP dbt-core's secret env vars written to package-lock.json in plaintext

Impact When used to pull source code from a private repository using a Personal Access Token PAT, some versions of dbt-core write a URL with the PAT in plaintext to the package-lock.yml file. Patches The bug has been fixed in dbt-core v1.7.3. Mitigations Remove any git URLs with plaintext secrets...