Vulnerability in recce (CVE-2026-49360)
Summary
Vulnerability in recce (CVE-2026-49360). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 1.50.0 or later.
Original description
The description as published by the source.
Impact
Recce OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API.
When Recce is configured with a DuckDB-backed project, an attacker can use DuckDB filesystem primitives to read and write files accessible to the Recce server process. The impact depends on how Recce is deployed, but may include disclosure of local files, tampering with Recce/dbt artifacts, modification of browser-served static files leading to stored XSS, and modification of application files if those paths are writable. If Recce is run as root, file access occurs with root privileges inside that host or container.
Patches
This issue has been patched in Recce v1.50.0. Users should upgrade to Recce v1.50.0 or later.
The patch restricts unsafe file read/write behavior for DuckDB-backed query execution and hardens the affected query path. Other warehouse adapters have also been reviewed for similar exposure.
Credits
Thanks to Sitampan (@hxcbtc) for responsibly reporting this issue.
Workarounds
Users who cannot upgrade immediately should avoid exposing recce server to the public internet or any untrusted network.
Recommended mitigations include enabling authentication or placing Recce behind an authenticated reverse proxy/VPN, running Recce as a non-root user, using a read-only application filesystem where possible, and ensuring that sensitive files…
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-49360 has been found in recce.
Risk of unauthorized operations or information disclosure.
What to do: upgrade recce to 1.50.0 or later.
If unsure, ask your IT team or search "recce CVE-2026-49360" on the vendor's site.
CVE-2026-49360 (recce) — CWE-73
Patched: 1.50.0 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-73) exists in recce.
Check the vendor advisory for the affected versions of recce.
Severity: ?. Risk of unauthorized operations or information disclosure.
Update to 1.50.0.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'recce' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'recce' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
recceを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade recce to 1.50.0ステージング環境で 1.50.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- package github.com
- web security-advisories@github.com
- web security-advisories@github.com
- web github.com
- web security-advisories@github.com