CVE-2026-100406: dbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve`
dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src/handlers/query.rs, which passes caller-supplied SQL to DuckDbViewsBackend::queryarrow() in crates/dbt-index-core/src/backend.rs without authorization or an allowlist. A client that can reach the server can invoke DuckDB filesystem-reading functions to read files available to the dbt process, including files outside the docs index directory. The server binds to localhost by default, but operators can expose it to a network through the host option or DBTDOCSHOST setting. This issue is fixed in version 2.0.0-alpha.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
dbtto a version that resolves this vulnerability.Fixed in 2.0.0-alpha.5
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
By default, the server binds to localhost, so remote clients cannot reach it unless the host option or DBT_DOCS_HOST setting exposes it to a network. Any client able to reach the server can use the affected endpoint without authentication.
What access does an attacker need, and what can they access?
An attacker only needs network access to the dbt docs server; no authentication is required. They can submit SQL that invokes DuckDB filesystem-reading functions and read files available to the dbt process, including files outside the docs index directory.
Which versions are affected and what version fixes the issue?
The issue affects versions from 2.0.0-alpha.0 until 2.0.0-alpha.5. It is fixed in 2.0.0-alpha.5.
What can be done if updating is not immediately possible?
Keep dbt docs serve bound to localhost and do not expose it through the host option or DBT_DOCS_HOST setting. Restrict network reachability so untrusted clients cannot access the POST /api/v1/query endpoint.