CVE-2026-49360

Received Received - Intake

Unauthenticated SQL Execution in Recce

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

Recce is a data-validation toolkit for enhanced dbt (data build tool) PR review. Prior to version 1.50.0, OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured with a DuckDB-backed project, an attacker can use DuckDB filesystem primitives to read and write files accessible to the Recce server process. The impact depends on how Recce is deployed, but may include disclosure of local files, tampering with Recce/dbt artifacts, modification of browser-served static files leading to stored XSS, and modification of application files if those paths are writable. If Recce is run as root, file access occurs with root privileges inside that host or container. This issue has been patched in Recce `v1.50.0`. Users should upgrade to Recce `v1.50.0` or later. The patch restricts unsafe file read/write behavior for DuckDB-backed query execution and hardens the affected query path. Other warehouse adapters have also been reviewed for similar exposure. Users who cannot upgrade immediately should avoid exposing `recce server` to the public internet or any untrusted network. Recommended mitigations include enabling authentication or placing Recce behind an authenticated reverse proxy/VPN, running Recce as a non-root user, using a read-only application filesystem where possible, and ensuring that sensitive files or credentials are not available to the Recce process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-49360

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

This vulnerability affects Recce, a data-validation toolkit for dbt PR review. Prior to version 1.50.0, unauthenticated users can execute arbitrary SQL queries through the query run API when the server is exposed to untrusted networks without authentication. This allows attackers to read or write files accessible to the Recce server process, especially when using DuckDB-backed projects.

Detection Guidance

To detect this vulnerability, check if your Recce server is exposed to an untrusted network without authentication. Verify the version of Recce installed; versions prior to 1.50.0 are vulnerable. Inspect network configurations to ensure the server is not publicly accessible. Look for unauthorized file access or modifications in directories accessible to the Recce process.

Impact Analysis

The impact depends on deployment. Possible consequences include disclosure of local files, tampering with Recce/dbt artifacts, stored XSS via modified static files, or modification of application files if writable. If Recce runs as root, file access occurs with root privileges on the host or container.

Compliance Impact

This vulnerability may lead to unauthorized file access, disclosure of sensitive data, or tampering with application files, which could violate GDPR (data protection) and HIPAA (health data confidentiality) requirements. Unauthorized access to local files or credentials could result in data breaches, non-compliance with data protection regulations, and potential legal penalties.

Mitigation Strategies

Immediately upgrade Recce to version 1.50.0 or later. If upgrading is not possible, restrict access to the Recce server by not exposing it to the public internet or untrusted networks. Enable authentication or place Recce behind an authenticated reverse proxy or VPN. Run Recce as a non-root user and use a read-only filesystem where possible.

Hi! I’m here to help you understand CVE-2026-49360. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70