dbt-mcp Telemetry Exposure of Sensitive MCP Tool Call Arguments
First seen Jul 16, 2026 · Updated Jul 16, 2026 · CVSS 3.1
The dbt-mcp server, prior to 1.17.1, sent full unredacted MCP tool call arguments—including raw SQL queries, variables, and node selection strings—to a third-party telemetry backend by default. Because usage tracking was enabled unless explicitly disabled via environment variables, organizations may have unknowingly leaked sensitive query content and internal data model details. This is a legitimate but low-complexity data exposure issue, not a remote code execution or agent-hijack vulnerability.
Technical Analysis
The vulnerability resides in DefaultUsageTracker.emit_tool_called_event(), which serialized the complete arguments dictionary of every MCP tool invocation (e.g., show's sql_query, run/build/test's vars, compile's node_selection) and forwarded it via dbtlabs_vortex.producer.log_proto without any redaction or filtering. Because usage_tracking_enabled defaulted to true unless DBT_SEND_ANONYMOUS_USAGE_STATS=false or DO_NOT_TRACK=1 was set, telemetry opt-out required affirmative action by the deploying organization. The entry point is any legitimate MCP client/agent invoking dbt tools through this server; the attacker gain is passive exposure of potentially sensitive SQL logic, table/column names, and internal business variables to the telemetry vendor's infrastructure, crossing the boundary between local agent-tool execution and an external analytics pipeline. There is no indication of active exploitation, injection, or privilege escalation—this is an over-collection/default-configuration privacy and confidentiality flaw.
Affected Systems
dbt-mcp; protocols: MCP
Detection Signatures
- Outbound network calls to dbtlabs_vortex / dbt Labs telemetry endpoints containing tool argument payloads
- Presence of sql_query, vars, or node_selection fields in emitted usage/telemetry event logs
- DBT_SEND_ANONYMOUS_USAGE_STATS or DO_NOT_TRACK environment variables absent or set to enable tracking
- MCP server logs showing emit_tool_called_event calls with full argument serialization prior to v1.17.1
Remediation Steps
- 1
Upgrade dbt-mcp
Update to version 1.17.1 or later, which fixes the unredacted telemetry serialization.
- 2
Disable telemetry explicitly
Set DBT_SEND_ANONYMOUS_USAGE_STATS=false or DO_NOT_TRACK=1 in all environments running dbt-mcp until upgraded.
- 3
Audit telemetry egress
Review historical telemetry traffic/logs for exposure of SQL queries, variables, or node selectors sent to dbt Labs infrastructure.
- 4
Enforce least-data telemetry policy
Adopt a policy requiring MCP servers and agent tools to redact or omit sensitive arguments before emitting any usage analytics.
- 5
Network egress monitoring
Monitor and optionally restrict outbound connections from MCP servers to third-party analytics endpoints in sensitive environments.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.