CVE-2026-55837: dbt-mcp Information Disclosure Vulnerability

CVE-2026-55837 Overview

CVE-2026-55837 is an information disclosure vulnerability [CWE-200] in dbt-mcp, a Model Context Protocol (MCP) server for interacting with dbt. Versions prior to 1.20.0 expose an unauthenticated GET /dbt_platform_context endpoint in the local OAuth helper at src/dbt_mcp/oauth/fastapi_app.py. The endpoint returns the full DbtPlatformContext, including access_token and refresh_token values, to any process that can reach 127.0.0.1:6785. The helper omits TrustedHostMiddleware, enabling DNS rebinding attacks against a victim's browser. The issue is fixed in version 1.20.0.

Critical Impact
Stolen tokens grant immediate dbt Platform API access as the victim and persistent access via the refresh token, allowing read or modification of projects, jobs, environment secrets, and account data.

Affected Products

dbt-mcp versions prior to 1.20.0
Local dbt Platform OAuth helper (src/dbt_mcp/oauth/fastapi_app.py)
Systems where the helper binds to 127.0.0.1:6785 after completing the OAuth flow

Discovery Timeline

2026-09-14 - CVE-2026-55837 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-55837

Vulnerability Analysis

The dbt-mcp OAuth helper runs a FastAPI application on the loopback interface after the user completes the dbt Platform OAuth flow. The helper exposes GET /dbt_platform_context without authentication, session binding, or origin validation. Any local process or browser context that can reach 127.0.0.1:6785 receives the persisted DbtPlatformContext, which contains the OAuth access_token and refresh_token.

Because the application does not register TrustedHostMiddleware, the server accepts arbitrary Host headers. This behavior enables DNS rebinding: a remote attacker controls a hostname whose DNS record rebinds to 127.0.0.1 after an initial resolution, causing the victim's browser to issue same-origin requests to the local helper. The endpoint responds with the tokens, which the attacker exfiltrates.

Root Cause

The root cause is missing access control and missing host validation on a sensitive localhost endpoint. The helper treats loopback reachability as an implicit trust boundary, which is unsafe when browsers, other local processes, or DNS rebinding can originate requests. Sensitive OAuth credentials are returned in the response body without any authorization check.

Attack Vector

An attacker uses one of two paths. A co-located process on the victim host queries http://127.0.0.1:6785/dbt_platform_context directly and reads the tokens. A remote attacker lures the victim to a controlled web page that performs DNS rebinding, causing the browser to fetch the same endpoint from what it treats as the attacker's origin. Once the tokens are exfiltrated, the attacker calls the dbt Platform API as the victim and refreshes access indefinitely.

python

 from fastapi import FastAPI, Request
 from fastapi.responses import RedirectResponse
 from fastapi.staticfiles import StaticFiles
+from starlette.middleware.trustedhost import TrustedHostMiddleware
 from starlette.types import Receive, Scope, Send
 from uvicorn import Server

Source: GitHub commit b8bdb40. The patch removes the unused helper endpoint and adds TrustedHostMiddleware so the server rejects requests with unexpected Host headers.

Detection Methods for CVE-2026-55837

Indicators of Compromise

HTTP requests to http://127.0.0.1:6785/dbt_platform_context originating from browser processes or non-dbt local tooling.
Outbound dbt Platform API calls from IP addresses or user agents that do not match the legitimate user's workstation profile.
Unexpected refresh-token use or new API sessions established shortly after a victim visited an untrusted web page.

Detection Strategies

Inspect endpoint process telemetry for unknown processes connecting to 127.0.0.1:6785.
Monitor browser DNS resolutions that return 127.0.0.1 for external hostnames, a hallmark of DNS rebinding.
Correlate dbt Platform audit logs for token issuance and job or secret modification events against expected user activity windows.

Monitoring Recommendations

Log and alert on all HTTP responses from local development helpers that include access_token or refresh_token fields.
Review dbt Platform environment secret reads and job configuration changes for anomalous source IPs.
Track installed dbt-mcp versions across developer workstations and flag installations below 1.20.0.

How to Mitigate CVE-2026-55837

Immediate Actions Required

Upgrade dbt-mcp to version 1.20.0 or later on every workstation running the OAuth helper.
Revoke and rotate all dbt Platform OAuth access_token and refresh_token values issued to affected users.
Audit dbt Platform projects, jobs, and environment secrets for unauthorized reads or modifications during the exposure window.

Patch Information

The fix is delivered in dbt-mcp v1.20.0 via pull request #789 and commit b8bdb40. The patch removes the unused OAuth helper endpoint and adds TrustedHostMiddleware to reject requests with unexpected Host headers. See GHSA-jr33-mw75-7j8f for the full advisory.

Workarounds

Stop the local OAuth helper immediately after completing the dbt Platform OAuth flow when upgrading is not yet possible.
Block inbound connections to TCP port 6785 on the loopback interface from browsers and untrusted local processes using a host firewall.
Restrict developer workstation browsing to trusted sites while the helper is running to reduce DNS rebinding exposure.

bash

# Upgrade dbt-mcp to the fixed release
pip install --upgrade 'dbt-mcp>=1.20.0'

# Verify the installed version
python -c "import importlib.metadata; print(importlib.metadata.version('dbt-mcp'))"