CVE-2026-49360: 
Python vulnerability analysis and mitigation

CVE-2026-49360 is an unauthenticated SQL execution vulnerability in the Recce OSS server that allows arbitrary local file read and write through DuckDB filesystem primitives. It affects all versions of the recce pip package up to and including v1.49.0, and was responsibly disclosed by researcher Sitampan (@hxcbtc). The advisory was published on June 1, 2026, and added to the GitHub Advisory Database on July 2, 2026. It carries a CVSS v4 base score of 7.8 (High) (GitHub Advisory, Recce Advisory).

The root cause is classified as CWE-73 (External Control of File Name or Path): the Recce server's query run API accepts and executes SQL queries without requiring authentication, and DuckDB's built-in filesystem primitives (e.g., read_csv, read_parquet, COPY TO) can be leveraged to read from or write to arbitrary paths accessible by the server process. An unauthenticated remote attacker simply sends a crafted HTTP request to the query run API endpoint containing a DuckDB SQL statement that references local filesystem paths. No privileges, user interaction, or special network position are required — the only precondition is that the Recce server is reachable from an untrusted network without authentication enabled (GitHub Advisory, Recce Advisory).

Successful exploitation can result in disclosure of any local files readable by the Recce server process (e.g., credentials, dbt profiles, environment variables), tampering with Recce/dbt artifacts, modification of browser-served static files leading to stored XSS attacks against users of the Recce UI, and overwriting application files if those paths are writable. If Recce is deployed running as root — a common pattern in containerized environments — the attacker gains file read/write access with root privileges within that host or container, significantly amplifying the blast radius and enabling potential container escape or full host compromise (GitHub Advisory, Recce Advisory).

The vulnerability is exploitable by any unauthenticated remote attacker with network access to the Recce server, requiring no special tools beyond the ability to send HTTP requests. No public PoC exploit code has been identified at this time, and there is no current evidence of in-the-wild exploitation or threat actor attribution. The CVE status remains "Reserved" and it has not been added to the CISA KEV catalog. Qualys has assigned detection ID 5015051 for this vulnerability (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-exposed Recce server instances (default port typically 8000) using tools like Shodan or Censys, or by scanning known internal network ranges. Confirm the server is running a DuckDB-backed project by observing API responses.
2. Locate the query run API: Identify the unauthenticated query execution endpoint (e.g., /api/runs or equivalent) by reviewing Recce's open-source API documentation or source code.
3. Craft a malicious DuckDB SQL payload: Construct a SQL statement using DuckDB filesystem primitives to read sensitive files, for example:

   SELECT * FROM read_csv_auto('/etc/passwd');

   Or to write a malicious file (e.g., a web shell into a static assets directory):

   COPY (SELECT '<script>alert(1)</script>') TO '/app/static/evil.js';

4. Submit the payload: Send an unauthenticated HTTP POST request to the query run API endpoint with the crafted SQL payload in the request body.
5. Retrieve results or trigger XSS: Read the API response to obtain exfiltrated file contents, or browse to the modified static file URL to trigger stored XSS in the Recce UI for any authenticated user who visits the page (GitHub Advisory, Recce Advisory).

• Network: Unexpected HTTP POST requests to the Recce query run API endpoint (e.g., /api/runs) from external or untrusted IP addresses; requests containing DuckDB filesystem function keywords such as read_csv, read_parquet, read_json, or COPY TO in the request body.
• Logs: Recce server access logs showing unauthenticated API calls to query execution endpoints with SQL payloads referencing filesystem paths (e.g., /etc/, /root/, /home/, .dbt/profiles.yml); error messages related to DuckDB external file access denial (relevant to patched versions).
• File System: Unexpected new or modified files in Recce static asset directories (e.g., .js, .html files with injected script content); missing or altered dbt artifact files (manifest.json, catalog.json); unexpected files written to writable application directories.
• Process: DuckDB process or Recce server process accessing files outside expected working directories; unusual file read patterns on sensitive paths such as /etc/passwd, SSH keys, or credential files (GitHub Advisory).

Users should upgrade to Recce v1.50.0 or later, which restricts unsafe file read/write behavior for DuckDB-backed query execution and hardens the affected query path (Recce v1.50.0 Release). For those unable to upgrade immediately, the following workarounds are recommended: avoid exposing recce server to the public internet or any untrusted network; enable authentication or place Recce behind an authenticated reverse proxy or VPN; run Recce as a non-root, least-privilege user; use a read-only application filesystem where possible; and ensure sensitive files or credentials (e.g., dbt profiles, cloud credentials) are not accessible to the Recce process (Recce Advisory).

The vulnerability was responsibly disclosed by security researcher Sitampan (@hxcbtc) and acknowledged by the Recce maintainers in the official advisory. The Recce team credited the researcher and released a patch in v1.50.0 alongside a public security advisory. No significant broader media coverage or notable community commentary beyond the official advisory has been identified at this time (Recce Advisory, Recce v1.50.0 Release).