dbt-core vulnerabilities
CVEs whose affected-version data names the dbt-core package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-100406High· 8.2PoCdbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications
dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/q…
▾ Midnightdbt-labs · dbt-coreEPSS 0.42%via NVD
CVE-2024-40637Medium· 4.2dbt has an implicit override for built-in materializations from installed packages
dbt has an implicit override for built-in materializations from installed packages
▾ Sunlitdbt-core · dbt-coreEPSS 0.37%via OSV
CVE-2024-36105Medium· 5.3dbt allows Binding to an Unrestricted IP Address via socketsocket
dbt allows Binding to an Unrestricted IP Address via socketsocket
▾ Sunlitdbt-core · dbt-coreEPSS 0.71%via OSV