CVE-2026-49360 Overview
CVE-2026-49360 is a high-severity vulnerability in Recce, a data-validation toolkit for reviewing dbt (data build tool) pull requests. Versions prior to 1.50.0 expose the OSS recce server query run API without authentication. When Recce is configured with a DuckDB-backed project, an attacker on an untrusted network can invoke DuckDB filesystem primitives through submitted queries. This allows unauthenticated read and write access to files reachable by the Recce server process. The vulnerability is tracked under CWE-73: External Control of File Name or Path and is documented in GitHub Security Advisory GHSA-rh62-j648-g5qc.
Critical Impact
Unauthenticated attackers can read local files, tamper with dbt artifacts, inject stored XSS into browser-served static files, and modify writable application files. If Recce runs as root, file operations execute with root privileges inside the host or container.
Affected Products
- Recce OSS server versions prior to v1.50.0
- Recce deployments configured with a DuckDB warehouse adapter
- Recce servers exposed to untrusted networks without authentication
Discovery Timeline
- 2026-08-21 - CVE-2026-49360 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-49360
Vulnerability Analysis
Recce's OSS server exposes a query run API that accepts SQL statements and executes them against the configured warehouse adapter. When the backend is DuckDB, the query engine supports filesystem primitives such as read_csv, read_json_auto, COPY ... TO, and related functions that operate on paths available to the server process. The query run API does not require authentication by default. An attacker with network reach to the server can submit crafted queries that invoke these primitives to read arbitrary files or write attacker-controlled content to writable locations.
The impact scope is bounded by the file paths accessible to the Recce process. Recce and dbt artifacts, browser-served static assets, and application files under the server's user context are all potential targets. Overwriting static assets served to reviewers introduces stored cross-site scripting (XSS) into the Recce UI. Running Recce as root elevates every read and write operation to root within the host or container filesystem.
Root Cause
The root cause is missing authentication on the query execution path combined with insufficient restriction of DuckDB filesystem functions. The server treats submitted SQL as trusted and passes it directly to DuckDB, which enforces no application-level path allow list.
Attack Vector
Exploitation requires network access to a Recce server that is exposed without authentication and configured with a DuckDB project. The attacker sends an HTTP request to the query run API containing a SQL statement that uses DuckDB file primitives. No user interaction is required. Technical details are described in the GHSA-rh62-j648-g5qc advisory and the PyPA advisory PYSEC-2026-3049.
Detection Methods for CVE-2026-49360
Indicators of Compromise
- HTTP requests to the Recce query run API from unexpected source addresses, particularly from outside the reviewer network
- SQL payloads referencing DuckDB file functions such as read_csv, read_json_auto, read_blob, or COPY ... TO '/path'
- Unexpected modifications to target/ dbt artifacts, Recce static assets, or files inside the Recce install directory
- New or modified JavaScript, HTML, or JSON files under Recce's browser-served static content paths
Detection Strategies
- Inspect Recce server access logs for POST requests to query execution endpoints originating from untrusted networks
- Enable file integrity monitoring on Recce application directories, dbt project target/ artifacts, and any static asset directories
- Alert on process activity where the Recce user account reads sensitive files outside the dbt project scope, such as /etc/passwd, SSH keys, or cloud credential files
Monitoring Recommendations
- Forward Recce server logs and host process telemetry to a centralized analytics platform for correlation with network access logs
- Baseline normal query patterns issued by Recce users and alert on deviations that include filesystem function calls
- Monitor the Recce container or host for unexpected outbound connections that may indicate exfiltration following file reads
How to Mitigate CVE-2026-49360
Immediate Actions Required
- Upgrade Recce to v1.50.0 or later, which restricts unsafe file read and write behavior on the DuckDB query path
- Remove any direct public internet exposure of recce server and restrict access to trusted networks only
- Audit the Recce process user; do not run the server as root, and restrict its filesystem permissions
- Rotate any credentials, tokens, or keys that were reachable from the Recce process filesystem while the server was exposed
Patch Information
The fix is available in Recce v1.50.0. According to the release notes, the patch restricts unsafe file read and write behavior for DuckDB-backed query execution and hardens the affected query path. The maintainers also reviewed other warehouse adapters for similar exposure.
Workarounds
- Place Recce behind an authenticated reverse proxy or require VPN access before reaching the server
- Enable authentication on the Recce deployment where supported by the configuration
- Run Recce as a non-root user and mount the application filesystem read-only where possible
- Ensure sensitive files, cloud credentials, and secrets are not present on paths accessible to the Recce process
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
