CVE-2026-44968 dbt-mcp: Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters

Medium 6.3 Published 16 Jul 2026 Updated 17 Jul 2026

Attackers can inject dbt CLI flags via MCP parameters to alter execution context, potentially leading to code execution or security bypasses.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-44968?

CVE-2026-44968 is a medium-severity command injection vulnerability in dbt-labs dbt-mcp, published on 16 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, _run_dbt_command() in src/dbt_mcp/dbt_cli/tools.py appended unsanitized node_selection and resource_type values to the dbt subprocess argument list, allowing an MCP client to inject dbt global flags such as --profiles-dir, --project-dir, and --target into subprocess.Popen even though shell=False prevents shell metacharacter injection. This issue is fixed in version 1.17.1.

Weakness: CWE-88

Which versions are affected by CVE-2026-44968?

3 open source packages ship an affected version, including dbt-mcp. It affects 1 product.

Package	Affected	Fixed in
`dbt-mcp` PyPI	All versions	`1.17.1`
`dbt-mcp` PyPI	All versions	`1.17.1`
`dbt-mcp` PyPI	All versions	`1.17.1`

Products include Getdbt Dbt Mcp Server.

How do I fix CVE-2026-44968?

Upgrade dbt-mcp to 1.17.1 or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-44968 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44968 exists.

Sources

Also known as GHSA-xpww-f6pm-cfhq, PYSEC-2026-2444.