CVE-2026-55837: dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.20.0, the local OAuth helper in src/dbt_mcp/oauth/fastapi_ap

Executive brief

dbt-mcp is a developer tool used to integrate dbt Cloud with other services. A security flaw in its local login helper allows unauthorized individuals or malicious websites to steal a user's dbt Cloud access tokens. If exploited, an attacker could gain full access to the victim's dbt projects, secrets, and data lineage, potentially leading to persistent unauthorized access to corporate data environments.

Technical details

The local FastAPI OAuth helper server in dbt-mcp exposes the 'GET /dbt_platform_context' endpoint without authentication or Host header validation. After a user completes an OAuth flow, this endpoint returns the full DbtPlatformContext object, including plaintext access_token and refresh_token values. An attacker can exfiltrate these tokens through a co-located process on the same host or via a remote DNS rebinding attack targeting the victim's browser. The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function) and is addressed in version 1.20.0 by adding Host validation and redacting sensitive tokens from the endpoint response.

Affected products

• dbt-labs dbt-mcp < 1.20.0

Timeline

• 2026-06-16: disclosed
• 2026-06-19: advisory: GHSA-jr33-mw75-7j8f published

References

• https://api.github.com/users/EQSTLab
• https://github.com/EQSTLab
• https://api.github.com/users/EQSTLab/gists%7B/gist_id%7D
• https://api.github.com/users/EQSTLab/repos
• https://avatars.githubusercontent.com/u/148991397?v=4
• https://api.github.com/users/EQSTLab/events%7B/privacy%7D