# dbt-mcp node_selection/resource_type Argument Injection (CVE-2026-44968)

- **Severity:** Medium
- **Signature ID:** `9be0892e-0f92-4207-af28-a7e5634960d5`
- **CVEs:** CVE-2026-44968
- **MITRE ATLAS:** AML.T0053 (AI Agent Tool Invocation)
- **OWASP:** ASI06 (Goal and Instruction Manipulation), LLM06 (Excessive Agency)

## Summary

dbt-mcp is a tool that lets AI agents run dbt commands. A bug in how it builds those commands allows an attacker to smuggle extra dbt command-line flags inside what should be a simple model selector or resource type, letting them redirect dbt to a different project, profile, or target of their choosing.

## How the attack works

An MCP client (or an agent acting on attacker-supplied input) calls a dbt-mcp tool such as build, run, test, or list, passing a node_selection string or resource_type list. dbt-mcp splits node_selection on spaces and appends resource_type entries directly to the dbt command's argument list without checking whether any token starts with a dash. An attacker adds a value like 'my_model --profiles-dir /tmp/evil' as the selector, and that extra flag rides along as a real dbt command-line argument. Because dbt is invoked without a shell, shell metacharacters don't work, but dbt's own global flags (--profiles-dir, --project-dir, --target, --profile) do, letting the attacker swap in a malicious profile, project directory, or target.

## Why it matters

An attacker can redirect dbt to read attacker-controlled configuration or write outputs to an attacker-chosen database or file path, effectively taking over where and how dbt runs without needing shell access.

## What you can do

- Validate node_selection and resource_type inputs and reject any token starting with a dash before passing them to dbt.
- Run dbt-mcp with a fixed, non-overridable profiles-dir, project-dir, and target rather than trusting caller-supplied values.
- Restrict which clients or agents can invoke build/compile/run/test/clone/list/get_node_details_dev tools.
- Review logs for node_selection or resource_type values containing dbt global flags (--profiles-dir, --project-dir, --target, --profile) that aren't legitimate selector syntax like tag: or config:.

## Known benign look-alikes

- A node_selection value that legitimately contains a dbt selector method using a colon (tag:, config:) rather than a dash-prefixed flag.
- Security advisory or PR text quoting the CVE-2026-44968 / GHSA-xpww-f6pm-cfhq payload for review purposes.
- A resource_type array containing only valid dbt resource type names (model, test, snapshot, source, etc.) with no injected flag.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01982
- https://nvd.nist.gov/vuln/detail/CVE-2026-44968
- https://github.com/advisories/GHSA-xpww-f6pm-cfhq

---
Source: https://www.netzilo.com/threats/atr-dbt-mcp-node-selection-resource-type-argument-injection-cve