dbt-mcp Local OAuth Helper Token Exposure via Unauthenticated Endpoint and DNS Rebinding

Technical Analysis

The vulnerability resides in fastapi_app.py's GET /dbt_platform_context endpoint, which returns the DbtPlatformContext object (access_token, refresh_token) after OAuth completion without requiring any authentication. Because the server lacks TrustedHostMiddleware, it accepts arbitrary Host headers, enabling a DNS rebinding attack where an attacker-controlled webpage causes the victim's browser to resolve a malicious domain to 127.0.0.1 and issue a request that the server treats as legitimate localhost traffic. Any other local process (e.g., malware, a malicious npm/pip dependency, or another MCP server sharing the host) can also directly query 127.0.0.1:6785 to harvest tokens. This crosses the tool/agent boundary by turning a local MCP helper meant to support an AI agent's dbt integration into a network-reachable credential store, giving the attacker durable API access to dbt projects, jobs, and environment secrets as the victim, even after the local session ends.

Affected Systems

dbt-mcp; protocols: MCP

Detection Signatures

• Unexpected inbound requests to 127.0.0.1:6785 or /dbt_platform_context from non-localhost Host headers
• HTTP requests to the OAuth helper lacking Authorization headers that still receive 200 responses
• DNS resolution of external domains to 127.0.0.1 followed by local HTTP callbacks
• Outbound dbt Platform API calls using tokens shortly after suspicious local port scans or browser-based cross-origin requests
• Presence of dbt-mcp versions prior to 1.20.0 in environment

Remediation Steps

1. 1

   Upgrade dbt-mcp

   Update to dbt-mcp version 1.20.0 or later, which fixes the unauthenticated context endpoint.

2. 2

   Enforce Host validation

   Ensure the local OAuth helper uses TrustedHostMiddleware or equivalent to reject requests with unexpected Host headers, mitigating DNS rebinding.

3. 3

   Require authentication on local endpoints

   Add a shared secret, token, or loopback-only binding with process verification for any endpoint that returns credentials, even on localhost.

4. 4

   Rotate exposed tokens

   Revoke and rotate dbt Platform access and refresh tokens for any account that used a vulnerable dbt-mcp version, and audit account activity for unauthorized access.

5. 5

   Restrict local port exposure

   Use host firewall rules to block non-essential processes from reaching MCP helper ports, and avoid running untrusted local software alongside sensitive MCP servers.