The vulnerability exists in the dbt "docs serve" feature, which exposes an unauthenticated POST /api/v1/query endpoint from versions 2.0.0-alpha.0 through 2.0.0-alpha.5. The endpoint forwards arbitrary client‑supplied SQL to DuckDB without any authorization checks or allowlist filtering. An attacker can thus execute arbitrary SQL commands, including DuckDB filesystem‑reading functions, and read files accessible to the dbt process, even files outside the docs index directory. This flaw enables local or remote data exfiltration and could allow an attacker to execute further malicious code via the database engine.

Affected product is dbt Core from dbt Labs. All installations that run dbt docs serve between 2.0.0-alpha.0 and 2.0.0-alpha.5 are vulnerable. service to localhost, but operators can expose it to a network by setting the host option or the DBT_DOCS_HOST environment variable. Therefore, systems that expose the service beyond the local host are at risk for external attackers, while those that keep it bound locally are only vulnerable to local compromise.

The vulnerability has a CVSS score of 8.2, indicating a high severity. No EPSS score is available, and the issue is not listed in CISA KEV, suggesting no confirmed active exploitation at the time of analysis. The attack vector is likely local when the service is bound to localhost; however, the vulnerability explicitly enables network‑based exploitation when the service is exposed. An attacker can send a POST request with malicious SQL to /api/v1/query to read arbitrary files or perform other dangerous operations. Given the lack of authentication and authorization, exploitation can be straightforward once network or local access is achieved. Organizations with exposed dbt docs serve should therefore consider immediate remediation.