title: dbt-mcp node_selection/resource_type Argument Injection (CVE-2026-44968)
id: ATR-2026-01982
rule_version: 1
status: experimental
description: |
  Detects CVE-2026-44968 / GHSA-xpww-f6pm-cfhq (CWE-88): dbt-mcp's _run_dbt_command() in src/dbt_mcp/dbt_cli/tools.py appends the MCP-client-supplied node_selection string (split on space) and resource_type JSON array verbatim to the dbt subprocess argv without validating that tokens don't begin with a dash. Because Popen is called with shell=False, shell metacharacters are inert, but an attacker can still inject dbt global flags — --profiles-dir, --project-dir, --target, --profile — as independent argv elements on the build/compile/run/test/ clone/list/get_node_details_dev tools, redirecting dbt's configuration, project root, or execution target (demonstrated PoC: node_selection = "my_model --profiles-dir /tmp/evil" loads an attacker-controlled profiles.yml and writes to an attacker-chosen database path).
  Detection covers: (a) a node_selection value containing an injected dbt global flag token
      after the legitimate selector (space-separated, so the flag rides
      along as an extra "word");
  (b) a resource_type JSON array containing an injected flag token as an
      array element instead of a valid resource type;
  (c) explicit CVE-2026-44968 / GHSA-xpww-f6pm-cfhq exploitation framing.
  The detection target is the request shape — a dash-prefixed dbt global flag riding inside a selector/resource-type value that should only ever contain a selector or resource-type token — which is the exact argument- injection primitive, caught before _run_dbt_command() extends argv. Bound to the dbt-mcp tool surface (node_selection/resource_type params) so a benign selector string elsewhere does not fire.
author: ATR Community
date: 2026/07/04
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: medium
references:
  owasp_llm:
    - LLM06:2025
  owasp_agentic:
    - ASI02:2026
  mitre_atlas:
    - AML.T0053 - AI Agent Tool Invocation
  mitre_attack:
    - T1059 - Command and Scripting Interpreter
  cve:
    - CVE-2026-44968
  ghsa:
    - GHSA-xpww-f6pm-cfhq
metadata_provenance:
  mitre_atlas: human-reviewed
  owasp_llm: human-reviewed
  owasp_agentic: human-reviewed
compliance:
  eu_ai_act:
    - article: '15'
      context: Article 15 cybersecurity — runtime detection of dbt-mcp node_selection/resource_type argument injection.
      strength: primary
    - article: '9'
      context: Article 9 risk management — runtime risk-treatment control for dbt-mcp node_selection/resource_type argument injection.
      strength: secondary
  nist_ai_rmf:
    - subcategory: MP.5.1
      context: MAP 5.1 — adversarial input characterised/detected for dbt-mcp node_selection/resource_type argument injection.
      strength: primary
    - subcategory: MG.3.2
      context: MANAGE 3.2 — runtime monitoring control for dbt-mcp node_selection/resource_type argument injection.
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: Clause 8.1 operational control — detection of dbt-mcp node_selection/resource_type argument injection payload.
      strength: primary
    - clause: '8.3'
      context: Clause 8.3 AI risk treatment — runtime detection as treatment control.
      strength: secondary
tags:
  category: tool-poisoning
  subcategory: argument-injection
  scan_target: mcp
  confidence: high
  source: cve-disclosure
  vendor_sources: dbt-mcp-cve-2026-44968
agent_source:
  type: tool_call
  framework:
    - dbt-mcp
    - any
  provider:
    - any
detection:
  condition: any
  false_positives:
    - A node_selection value that legitimately contains a dbt selector method using a colon (tag:, config:) rather than a dash-prefixed flag.
    - Security advisory or PR text quoting the CVE-2026-44968 / GHSA-xpww-f6pm-cfhq payload for review purposes.
    - A resource_type array containing only valid dbt resource type names (model, test, snapshot, source, etc.) with no injected flag.
  conditions:
    - field: tool_args
      operator: regex
      value: (?i)\bnode_selection["\x27]?\s*[:=]\s*["\x27][^"\x27\n]{0,200}\s(?:--profiles-dir|--project-dir|--target|--profile)\b
      description: |
        node_selection value whose space-separated tokens include an injected dbt global flag (--profiles-dir/--project-dir/--target/ --profile) after the legitimate selector — CVE-2026-44968 Vector 1.
    - field: tool_args
      operator: regex
      value: (?i)\bresource_type["\x27]?\s*[:=]\s*\[[^\]\n]{0,200}["\x27](?:--profiles-dir|--project-dir|--target|--profile)["\x27][^\]\n]{0,200}\]
      description: |
        resource_type JSON array containing an injected dbt global flag token as an array element instead of a valid resource type — CVE-2026-44968 Vector 2.
    - field: tool_args
      operator: regex
      value: (?i)--(?:profiles-dir|project-dir|target|profile)\s+["\x27]?/tmp/[^"\x27\s\n]{0,80}["\x27]?[\s\S]{0,120}\b(?:node_selection|resource_type|--select|--resource-type)\b
      description: |
        An injected dbt global flag pointing at an attacker-controlled path appearing alongside the vulnerable --select/--resource-type argv construction.
    - field: content
      operator: regex
      value: (?i)(?:CVE-2026-44968|GHSA-xpww-f6pm-cfhq)[\s\S]{0,200}(?:dbt-mcp|node_selection|resource_type|profiles-dir|argument\s*inject)
      description: |
        Explicit CVE-2026-44968 / GHSA-xpww-f6pm-cfhq reference combined with dbt-mcp argument-injection language — attack framing in a skill or tool description.
response:
  actions:
    - alert
    - block_tool
  message_template: |
    [ATR-2026-01982] MEDIUM: dbt-mcp node_selection/resource_type argument injection detected (CVE-2026-44968, CWE-88). A tool argument injects a dbt global flag (--profiles-dir/--project-dir/--target) as an argv element; dbt-mcp before 1.17.1 appends this to the dbt subprocess unsanitized. Block the tool call and upgrade dbt-mcp to >= 1.17.1.
confidence: 80