dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to version 1.17.1, the DbtMCP.call_tool() method logged the raw arguments dictionary at INFO level before each tool call and at ERROR level on exceptions, and the configure_file_logging() routine wrote these records to the dbt‑mcp.log file when the DBT_MCP_SERVER_FILE_LOGGING environment variable was set to true. The logged data include unredacted sql_query, vars, and node_selection values, which can contain database credentials or other secrets, exposing confidential information in plaintext. This vulnerability is classified as CWE‑532 and has been fixed in dbt‑mcp version 1.17.1.

dbt‑labs dbt‑mcp versions earlier than 1.17.1 are impacted when file logging is enabled via the DBT_MCP_SERVER_FILE_LOGGING environment variable. The issue is specifically tied to the DbtMCP.call_tool() method and the configure_file_logging() routine that writes log entries to dbt‑mcp.log. Users running older releases in environments where log files may be accessible or where log rotation is inadequate are therefore at risk.

The CVSS score of 2.5 indicates a low severity, and the EPSS score of less than 1% reflects an extremely low probability of exploitation. The vulnerability is not cataloged in the CISA KEV list. Attackers would need the ability to read the log files generated by dbt‑mcp to obtain the exposed credentials, which may be feasible for local users or potential escalation scenarios. Because the flaw does not support arbitrary code execution and requires a file logging configuration, the overall risk remains low but still warrants remediation. The bug was addressed in dbt‑mcp v1.17.1.