CVE-2026-49360

Name of the Vulnerable Software and Affected Versions Recce versions prior to 1.50.0

Description Recce OSS server deployments exposed to untrusted networks without authentication allow unauthenticated SQL execution via the query run API endpoint. When configured with a DuckDB-backed project, an attacker can utilize DuckDB filesystem primitives to read and write files accessible to the server process. This can lead to the disclosure of local files, tampering with Recce or dbt artifacts, and modification of application files or browser-served static files, which may result in stored Cross-Site Scripting (XSS). If the server is executed with root privileges, file access is granted with root permissions within the host or container.

Recommendations Update to Recce version 1.50.0 or later. Avoid exposing the server to the public internet or untrusted networks. Enable authentication or place the server behind an authenticated reverse proxy or VPN. Run the server as a non-root user. Use a read-only application filesystem where possible. Ensure sensitive files and credentials are not accessible to the server process.