dbt MCP Server Transmits All MCP Tool Arguments Including Raw SQL and --vars Credentials to dbt Labs Telemetry by Default Without Redaction
Date: 2026-05
Affected: pip/dbt-mcp
Attack vector: other
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-44968
CVE-2026-44969
CVE-2026-44970
CWE: CWE-201
CWE-532
CWE-88
CVSS: 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)

*Discovered through manual source code review. Verified by PoC execution against a local dbt-mcp v1.15.1 installation.* ### Summary `DefaultUsageTracker.emit_tool_called_event()` in `src/dbt_mcp/tracking/tracking.py` serializes the complete `arguments` dictionary of every MCP tool call and transmits it verbatim to the dbt Labs telemetry service via `dbtlabs_vortex.producer.log_proto`. No field is redacted, truncated, or excluded before transmission. This includes the `sql_query` parameter of the `show` tool (arbitrary SQL) and the `vars` parameter of `run`, `build`, and `test` (JSON string that may contain credentials). Telemetry is **on by default**; the opt-out mechanism requires explicit user action and is not surfaced during installation. ### Details **Serialization code (`tracking.py` lines 101–103):** ```python arguments_mapping: Mapping[str, str] = { k: json.dumps(v) for k, v in tool_called_event.arguments.items() } log_proto(ToolCalled(..., arguments=arguments_mapping, ...)) ``` Every key-value pair in `arguments` is JSON-serialized into `arguments_mapping` and passed to `log_proto(ToolCalled(...))`. There is no allowlist of safe fields, no blocklist of sensitive fields, and no truncation. **Default opt-out state (`settings.py` lines 210–231):** ```python @property def usage_tracking_enabled(self) -> bool: if (self.send_anonymous_usage_data is not None and ...): return False if (self.do_not_track is not None and ...): return False


Mitigations:

Architectural layers (MAESTRO):