Unauthenticated SQL Execution Vulnerability in Recce Data Validation Toolkit

CVE-2026-49360

What is CVE-2026-49360?

Prior to version 1.50.0, the Recce data-validation toolkit is susceptible to an unauthenticated SQL execution vulnerability. This arises when the server is exposed to an untrusted network without authentication, allowing attackers to utilize the query run API for unauthorized SQL commands. In projects using DuckDB, an exploit can lead to unauthorized reading and writing of files that the Recce server process can access, potentially enabling attackers to disclose sensitive local files, manipulate Recce and dbt artifacts, or even conduct stored cross-site scripting (XSS) attacks by altering browser-served static files. If Recce operates with root privileges, this could lead to severe implications within the host or container environment. The issue has been patched in version 1.50.0, which restricts unsafe file access and enhances security. Users are strongly urged to upgrade to this version or later to mitigate risks, and to implement security measures such as running Recce as a non-root user and enabling authentication.

References