Unrated

Unauthenticated token disclosure in dbt MCP Server local OAuth helper

IdentifiersCVE-2026-55837CWE-306

dbt MCP Server contains an unauthenticated local OAuth helper endpoint exposed on 127.0.0.1:6785 that returns dbt Platform context data via GET /dbt_platform_context. According to the provided advisory, this response can include dbt Cloud access_token and refresh_token values. Because the endpoint lacks authentication/authorization, an attacker able to reach the local helper can retrieve these bearer tokens directly. The issue affects the local OAuth helper design rather than a memory corruption flaw: sensitive token-bearing context is exposed through an unauthenticated HTTP endpoint, and the advisory notes reachability may occur from a co-located local process or through DNS rebinding.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows theft of the victim's dbt Cloud access and refresh tokens. This enables immediate unauthorized API access as the victim and can provide persistent access by using the refresh token to mint new access tokens. The advisory states this may allow reading or modifying dbt projects, running jobs, accessing environment secrets, and exfiltrating stored credentials and lineage data.

Mitigation

If you can’t patch tonight, do this now.

Restrict the local FastAPI helper to trusted hosts such as localhost and 127.0.0.1, implement host/origin validation, and redact or suppress token-bearing fields from the /dbt_platform_context response. Additional hardening should include authentication and authorization on the endpoint, plus protections against DNS rebinding and cross-origin abuse.

Remediation

Patch, then assume compromise.

Upgrade dbt-mcp to version 1.20.0 or later, which fixes the issue. If an immediate upgrade is not possible, avoid running the vulnerable OAuth helper, minimize exposure of the local service, and remove or protect token-bearing context data returned by the helper.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

dbt LabsDbt-Mcpapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

1 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity1