Description

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.20.0, the local OAuth helper in src/dbt_mcp/oauth/fastapi_app.py exposes GET /dbt_platform_context without authentication or Host validation after a user completes the dbt Platform OAuth flow. The endpoint returns the full DbtPlatformContext, including access_token and refresh_token values persisted by the context manager, to any process that can reach 127.0.0.1:6785. The absence of TrustedHostMiddleware allows a remote attacker to use DNS rebinding against a victim's browser because the helper accepts arbitrary Host headers, while a co-located process can request the endpoint directly. The stolen tokens provide immediate dbt Platform API access as the victim and persistent access through the refresh token, allowing access to or modification of projects, jobs, environment secrets, and related account data. This issue is fixed in version 1.20.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-14T17:17:48.547Z",
  "pubdate": "2026-09-14T17:17:48.547Z",
  "executiveSummary": "The dbt-mcp library prior to version 1.20.0 contains a critical authentication bypass vulnerability in its local OAuth helper mechanism. Located within src/dbt_mcp/oauth/fastapi_app.py, the GET /dbt_platform_context endpoint fails to implement necessary authentication checks or Host header validation.\nThis flaw allows unauthorized access to sensitive DbtPlatformContext data, including OAuth access and refresh tokens. Any process capable of interacting with the local loopback interface (127.0.0.1:6785) can successfully exfiltrate these credentials.\nThe vulnerability also exposes users to DNS rebinding attacks, where a remote attacker can manipulate the browser to bypass same-origin policies due to the lack of TrustedHostMiddleware. Successful exploitation grants an attacker full API access to the victim's dbt Platform account, enabling unauthorized project modification, environment secret exfiltration, and long-term persistence via refresh tokens. The risk is considered high due to the sensitivity of the exposed credentials and the ease of local or remote exploitation.",
  "technicalDetails": "The vulnerability resides in the FastAPI-based local OAuth helper implemented in src/dbt_mcp/oauth/fastapi_app.py. The application provides an endpoint, GET /dbt_platform_context, which serves to return the DbtPlatformContext object to the client after a successful OAuth flow. However, the implementation lacks any form of request authentication or authorization, allowing any local process or browser-based script to query the endpoint and receive the full context, including sensitive tokens.\nThe absence of TrustedHostMiddleware exacerbates the risk by permitting the application to accept arbitrary Host headers. This configuration introduces a significant attack vector via DNS rebinding. By controlling a malicious domain that resolves to 127.0.0.1, an attacker can trick a victim’s browser into performing requests against the local dbt-mcp server, bypassing origin-based security protections.\nThe attack flow for a DNS rebinding scenario involves: 1) The attacker lures the victim to a malicious website. 2) The website triggers the browser to perform a request to a domain that initially resolves to an attacker-controlled server, but subsequently maps to 127.0.0.1 via a low Time-to-Live (TTL) DNS record. 3) Because the local server accepts the attacker-provided Host header, the request to /dbt_platform_context is processed successfully. 4) The application returns the DbtPlatformContext, containing the access_token and refresh_token, to the attacker's script.\nIn a co-located attack, any malicious process running on the host machine can directly query the local service port 6785 without needing to navigate browser-based restrictions. Once the tokens are compromised, the attacker can impersonate the victim against the dbt Platform API. Given that the context includes refresh tokens, the attacker can maintain persistent access to the victim’s environment, allowing for the exfiltration of environment secrets, the manipulation of job configurations, and unauthorized modifications to dbt projects.\nThe vulnerable component is explicitly the local OAuth helper functionality within versions prior to 1.20.0. The lack of validation for both the request origin and the identity of the requester transforms a utility intended for local credential hand-off into a high-privilege information disclosure vulnerability."
}