CVE-2026-100406 | dbt-labs dbt-core up to 2.0.0-alpha.4 Docs Serve query.rs query_arrow improper authorization

October 14, 2026 Yanac

A vulnerability, which was classified as critical, has been found in dbt-labs dbt-core up to 2.0.0-alpha.4. Affected is the function DuckDbViewsBackend::query_arrow of the file crates/dbt-docs-server/src/handlers/query.rs of the component Docs Serve. Performing a manipulation results in improper authorization.

This vulnerability is cataloged as CVE-2026-100406. It is possible to initiate the attack remotely. There is no exploit available.

It is advisable to upgrade the affected component.VulDB Recent EntriesRead More