dbt-mcp Argument Injection via Unsanitized node_selection/resource_type Parameters
First seen Jul 16, 2026 · Updated Jul 16, 2026 · CVSS 6.3
The dbt-mcp MCP server, prior to version 1.17.1, failed to sanitize client-supplied node_selection and resource_type values before passing them as dbt CLI arguments. Although the use of shell=False blocks shell metacharacter injection, an MCP client could still smuggle dbt global flags like --profiles-dir, --project-dir, or --target into the subprocess call, allowing unauthorized redirection of dbt execution context.
Technical Analysis
The vulnerability resides in _run_dbt_command() in src/dbt_mcp/dbt_cli/tools.py, where user- or agent-supplied values for node_selection and resource_type are concatenated directly into the argument list passed to subprocess.Popen. Because these values are not validated to exclude dbt flag syntax (e.g., strings beginning with '--'), a malicious or compromised MCP client can inject arbitrary dbt global flags such as --profiles-dir or --project-dir, effectively altering which project directory, profile, or target dbt operates against. This crosses a trust boundary between the MCP client (potentially an LLM-driven agent acting on untrusted planning input) and the underlying dbt CLI process, enabling the attacker to redirect dbt operations to attacker-controlled configuration or credentials without needing shell access. The impact is scoped to argument-level manipulation rather than full command injection, but it can still lead to data exposure, credential misuse, or execution against unintended environments.
Affected Systems
dbt-mcp; protocols: MCP
Detection Signatures
- Look for node_selection or resource_type values beginning with '--' or '-' in MCP tool call logs
- Monitor dbt subprocess invocations for unexpected global flags: --profiles-dir, --project-dir, --target
- Audit MCP tool call payloads for argument-like strings in fields expected to contain resource identifiers or selectors
- Alert on dbt CLI executions referencing profile/project directories outside the expected sanctioned paths
Remediation Steps
- 1
Upgrade dbt-mcp
Update to dbt-mcp version 1.17.1 or later, which sanitizes node_selection and resource_type inputs before subprocess execution.
- 2
Input validation on tool parameters
Implement strict allow-listing or regex validation on all parameters passed into subprocess argument lists, rejecting any values starting with '-' or matching known CLI flag patterns.
- 3
Principle of least privilege for dbt execution
Run the dbt-mcp server with a restricted, dedicated dbt profile and project directory that cannot be overridden, and apply filesystem permissions preventing access to alternate profiles/projects.
- 4
MCP client trust boundary review
Treat all MCP client-supplied tool arguments as untrusted input; apply server-side validation regardless of client identity or claimed intent.
- 5
Audit logging of subprocess arguments
Log the full resolved argument list passed to subprocess.Popen for dbt commands to enable post-hoc detection of injected flags.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.