CVE-2026-100406

CVE-2026-100406 · dbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve`

This page contains facts from public vulnerability sources. Check the original advisory before updating.

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src/handlers/query.rs, which passes caller-supplied SQL to DuckDbViewsBackend::query_arrow() in crates/dbt-index-core/src/backend.rs without authorization or an allowlist. A client that can reach the server can invoke DuckDB filesystem-reading functions to read files available to the dbt process, including files outside the docs index directory. The server binds to localhost by default, but operators can expose it to a network through the host option or DBT_DOCS_HOST setting. This issue is fixed in version 2.0.0-alpha.5.

CVSS 8.2 · High · EPSS 0.3%

Published

2026-10-14T18:27:24.863Z

Updated

2026-10-20T01:51:20.549Z

Check your server →