Lucene search
+L

1 matches found

Github Security Blog
Github Security Blog
added 2026/05/14 6:24 p.m.15 views

dbt MCP Server Logs Tool Arguments Including SQL Queries and Credentials in Plaintext Without Redaction When File Logging Is Enabled

Discovered through manual source code review. Verified by PoC execution against a local dbt-mcp v1.15.1 installation. Summary DbtMCP.calltool in src/dbtmcp/mcp/server.py logs the complete raw arguments dictionary at INFO level on every tool invocation line 67 and again at ERROR level if the call...

3.3CVSS6AI score0.00148EPSS
SaveExploits1References3Affected Software1
Rows per page
Query Builder