PT-2026-59113

Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens Summary The local OAuth helper FastAPI server bundled with dbt-mcp exposes the GET /dbt platform context endpoint without any form of authentication or host-origin validation. After a user completes the OAuth login flow against dbt...