CVE-2026-100406
8.2HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-22, CWE-200, CWE-306
Impact
Unauthenticated attackers with network access to dbt docs serve can read arbitrary files accessible to the dbt process. They do this by executing caller-supplied DuckDB queries via an exposed API endpoint.
Root cause
The POST /api/v1/query endpoint lacks authentication and passes raw user-supplied SQL directly to DuckDB without an allowlist, permitting filesystem read functions.
Affected systems
dbt 2.0.0-alpha.0 through versions prior to 2.0.0-alpha.5
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade to dbt 2.0.0-alpha.5 or later. If patching immediately is not possible, stop exposing dbt docs serve to external networks and ensure DBT_DOCS_HOST or the host option binds strictly to localhost (127.0.0.1).
$ pip install --upgrade 'dbt>=2.0.0-alpha.5'AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src/handlers/query.rs, which passes caller-supplied SQL to DuckDbViewsBackend::query_arrow() in crates/dbt-index-core/src/backend.rs without authorization or an allowlist. A client that can reach the server can invoke DuckDB filesystem-reading functions to read files available to the dbt process, including files outside the docs index directory. The server binds to localhost by default, but operators can expose it to a network through the host option or DBT_DOCS_HOST setting. This issue is fixed in version 2.0.0-alpha.5.