dbt docs server CVE-2026-100406

Two concrete prerequisites must hold: (1) a running dbt docs serve instance on an affected pre-release version (2.0.0-alpha.0 through 2.0.0-alpha.4), and (2) network reachability of that instance - which is NOT the default, since the server binds to localhost unless the operator sets the host option or the DBT_DOCS_HOST environment variable to a non-loopback address. When both hold, the POST /api/v1/query endpoint accepts attacker-supplied SQL with no authorization and no allowlist, allowing invocation of DuckDB filesystem-reading functions limited only by the filesystem permissions of the dbt process. The primary limiting factor is the default localhost binding (captured as AT:P): on an unmodified deployment, exploitation is local-only and remote attack requires an explicit operator misconfiguration/exposure. No user interaction or authentication is required once the endpoint is reachable.

The input CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H) yields a base score of 8.2 (High), driven by an unauthenticated, network-reachable endpoint that exposes high-impact confidentiality loss (arbitrary file read) with no integrity or availability impact (VI:N/VA:N). Crucially, the vector sets AT:P (attack requirements present), which aligns with the description: the server binds to localhost by default, so remote exploitation is only possible where an operator has intentionally exposed it via the host option or DBT_DOCS_HOST - this is the single most important risk-dampening factor and explains why the score is not higher despite PR:N/UI:N. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; exploitation probability cannot be quantified from the data given. The affected range is confined to pre-release alpha builds (2.0.0-alpha.0 through alpha.4), which sharply narrows the real-world exploitable population. Net assessment: a genuinely serious confidentiality flaw for the specific subset of deployments that network-expose dbt docs serve, but low blast radius overall given the default-localhost binding and the alpha-only version window - treat as a priority only where the host/DBT_DOCS_HOST exposure is in use. No contradictory signals beyond the AV:N-vs-AT:P nuance, which the vector itself already reconciles.

An attacker who can reach a dbt docs server that an operator has bound to a network interface (via the host option or DBT_DOCS_HOST) sends an unauthenticated POST to /api/v1/query containing SQL that invokes DuckDB filesystem-reading functions to read files accessible to the dbt process - for example profiles.yml, credential files, or other secrets outside the docs index directory - and receives the file contents in the JSON response. Because AV:N/AC:L/PR:N/UI:N applies once the server is reachable, exploitation requires only a single crafted HTTP request with no authentication or user interaction. No public exploit identified at time of analysis.