dbt docs serve: Unauthenticated arbitrary SQL execution allows file read
Summary
dbt docs serve in dbt-core 2.0.0-alpha.0 up to 2.0.0-alpha.5 (excluding alpha.5) provides an unauthenticated POST /api/v1/query endpoint that runs caller-supplied SQL. An attacker who can reach the server can use DuckDB file-reading functions to read files the dbt process can access, including files outside the docs index directory. The server binds to localhost by default, so the risk mainly applies where operators expose it to a network via the host option or DBT_DOCS_HOST.
Affected
- dbt-core 2.0.0-alpha.0 up to, but not including, 2.0.0-alpha.5
- Only the dbt docs serve component is affected.
Fixed in
- Fixed in dbt-core 2.0.0-alpha.5. The ad-hoc SQL query endpoints were removed in commit 3a5d26f.
Workaround
- Unknown. No vendor-documented workaround is available.
- Keep the docs server bound to localhost and do not expose it through firewall, NAT or container port rules until it is patched.
Exploitation
- CISA SSVC assessment: exploitation 'poc', automatable: yes, technical impact: partial.
- Not listed as known exploited (KEV) in the sources reviewed.
- No public proof of concept was found in our research, but the CISA assessment indicates one may exist.
Our recommendation
- Identify dbt-core builds in the 2.0.0-alpha series and upgrade to 2.0.0-alpha.5 or later.
- Check whether any dbt docs server listens on a non-local address (host option or DBT_DOCS_HOST) and restrict it to localhost.
- If the server runs in a container, rebuild the image and confirm the dbt binary version.
- Review access to profile and credential files on hosts running the affected server.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- dbt-labs/dbt commit 3a5d26f (fix) github.com
- dbt v2.0.0-alpha.5 release github.com
- GitHub Security Advisory GHSA-h2j2-2r7g-rff8 github.com
- OSV: CVE-2026-100406 osv.dev
- VulDB 420310 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:16.
Original description (NVD)
dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src/handlers/query.rs, which passes caller-supplied SQL to DuckDbViewsBackend::query_arrow() in crates/dbt-index-core/src/backend.rs without authorization or an allowlist. A client that can reach the server can invoke DuckDB filesystem-reading functions to read files available to the dbt process, including files outside the docs index directory. The server binds to localhost by default, but operators can expose it to a network through the host option or DBT_DOCS_HOST setting. This issue is fixed in version 2.0.0-alpha.5.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.