dbt-mcp versions before 1.20.0 contain a security flaw in the local OAuth helper where the GET /dbt_platform_context endpoint returns the full DbtPlatformContext, including sensitive access_token and refresh_token values, without requiring authentication or validating the Host header. This endpoint listens on 127.0.0.1:6785 and lacks TrustedHostMiddleware, allowing remote attackers to exploit DNS rebinding attacks against a victim's browser or local processes to retrieve tokens. The stolen tokens grant immediate and persistent access to the dbt Platform API as the victim, enabling unauthorized access or modification of projects, jobs, environment secrets, and related account data. The vulnerability is addressed in dbt-mcp version 1.20.0.

Exposure of OAuth access and refresh tokens to unauthorized actors can lead to immediate and persistent unauthorized access to the dbt Platform API. Attackers can access or modify projects, jobs, environment secrets, and account data, potentially compromising the integrity and confidentiality of the victim's dbt environment. The vulnerability requires local network or DNS rebinding attack vectors but does not require prior privileges or user interaction beyond OAuth flow completion.

Upgrade dbt-mcp to version 1.20.0 or later, where this vulnerability is fixed. The vendor has provided an official fix that adds authentication and host validation to the affected endpoint. Until upgrading, restrict access to 127.0.0.1:6785 and monitor for suspicious local or DNS rebinding activity. Patch status is confirmed fixed in 1.20.0.