Attack Chain

1. An unauthenticated attacker identifies a vulnerable Recce OSS server (<= v1.49.0) exposed to an untrusted network.
2. The attacker sends a specially crafted HTTP request to the Recce server's query run API endpoint.
3. The request payload contains SQL commands leveraging DuckDB syntax and filesystem primitives, bypassing authentication.
4. The Recce server, running with a DuckDB-backed project, processes the malicious SQL query.
5. The embedded DuckDB filesystem functions (e.g., READ_CSV, COPY) are executed to access the server's local file system.
6. The attacker reads sensitive local files (e.g., /etc/passwd, database credentials, application configuration).
7. Alternatively, the attacker writes malicious content to server-accessible paths (e.g., modifying static files for stored XSS or corrupting application files).
8. Successful exploitation leads to data exfiltration, system compromise, or persistent defacement, with potential root privileges if the Recce process is running as root.

Impact

The observed impact of this vulnerability depends heavily on the Recce server's deployment configuration. Attackers can achieve unauthorized disclosure of local files, potentially exposing sensitive data, configuration files, or credentials accessible to the Recce server process. Tampering with Recce or dbt artifacts could lead to data integrity issues or supply chain attacks. Modification of browser-served static files might result in stored Cross-Site Scripting (XSS), affecting users interacting with the Recce interface. Furthermore, if application files themselves are writable, attackers could modify core application logic. If the Recce server is running with root privileges (a misconfiguration), the file access can occur with full root capabilities, leading to complete host or container compromise.

Recommendation

• Patch CVE-2026-49360 immediately: Upgrade all Recce server deployments to v1.50.0 or later, as specified in the patches section of the advisory.
• Implement network access controls: Ensure recce server is not exposed to the public internet or any untrusted network, as mentioned in the workarounds section.
• Deploy behind an authenticated proxy: Place Recce behind an authenticated reverse proxy or VPN to enforce access control, as suggested in the workarounds section.
• Enforce least privilege: Run the Recce server process as a non-root user to limit the scope of file access in case of compromise, as advised in the workarounds section.
• Restrict file system access: Configure the application's filesystem as read-only where possible, and ensure sensitive files or credentials are not accessible to the Recce process.
• Deploy the Sigma rule below: Use the provided Detect CVE-2026-49360 Exploitation - Recce DuckDB File Operations rule in your SIEM to identify attempts to exploit this vulnerability.