dbt-mcp node_selection/resource_type Argument Injection (CVE-2026-44968)
dbt-mcp is a tool that lets AI agents run dbt commands. A bug in how it builds those commands allows an attacker to smuggle extra dbt command-line flags inside what should be a simple model selector or resource type, letting them redirect dbt to a different project, profile, or target of their choosing.
How the attack works
An MCP client (or an agent acting on attacker-supplied input) calls a dbt-mcp tool such as build, run, test, or list, passing a node_selection string or resource_type list. dbt-mcp splits node_selection on spaces and appends resource_type entries directly to the dbt command's argument list without checking whether any token starts with a dash. An attacker adds a value like 'my_model --profiles-dir /tmp/evil' as the selector, and that extra flag rides along as a real dbt command-line argument. Because dbt is invoked without a shell, shell metacharacters don't work, but dbt's own global flags (--profiles-dir, --project-dir, --target, --profile) do, letting the attacker swap in a malicious profile, project directory, or target.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 9be0892e-0f92-4207-af28-a7e5634960d5
- Severity
- Medium
- CVEs
- CVE-2026-44968
Why it matters
An attacker can redirect dbt to read attacker-controlled configuration or write outputs to an attacker-chosen database or file path, effectively taking over where and how dbt runs without needing shell access.
What you can do
- →Validate node_selection and resource_type inputs and reject any token starting with a dash before passing them to dbt.
- →Run dbt-mcp with a fixed, non-overridable profiles-dir, project-dir, and target rather than trusting caller-supplied values.
- →Restrict which clients or agents can invoke build/compile/run/test/clone/list/get_node_details_dev tools.
- →Review logs for node_selection or resource_type values containing dbt global flags (--profiles-dir, --project-dir, --target, --profile) that aren't legitimate selector syntax like tag: or config:.
Known benign look-alikes
- A node_selection value that legitimately contains a dbt selector method using a colon (tag:, config:) rather than a dash-prefixed flag.
- Security advisory or PR text quoting the CVE-2026-44968 / GHSA-xpww-f6pm-cfhq payload for review purposes.
- A resource_type array containing only valid dbt resource type names (model, test, snapshot, source, etc.) with no injected flag.