CVSS 4.0
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Атакува се
Време до експлоатация
Атакува се по мрежата, без особени условия, само при определена конфигурация или състояние на системата, без вход и без действие от потребителя.
- Експлоатация: има публичен пример за експлоатация
- Атаката може да се автоматизира
Описание
Оригинално описание
dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src/handlers/query.rs, which passes caller-supplied SQL to DuckDbViewsBackend::query_arrow() in crates/dbt-index-core/src/backend.rs without authorization or an allowlist. A client that can reach the server can invoke DuckDB filesystem-reading functions to read files available to the dbt process, including files outside the docs index directory. The server binds to localhost by default, but operators can expose it to a network through the host option or DBT_DOCS_HOST setting. This issue is fixed in version 2.0.0-alpha.5.
Засегнати продукти
- dbt-labs dbt-core: >= 2.0.0-alpha.0, < 2.0.0-alpha.5
Вид слабост
История
- 14 октомври 2026 Публикувано
Други уязвимости в dbt-labs dbt-core
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-100406
- https://nvd.nist.gov/vuln/detail/CVE-2026-100406
- https://github.com/dbt-labs/dbt/security/advisories/GHSA-h2j2-2r7g-rff8
- https://github.com/dbt-labs/dbt/commit/3a5d26fe02b58382720d04cbd87143b7b6775413
- https://github.com/dbt-labs/dbt/releases/tag/v2.0.0-alpha.5