01 Record

CVE-2026-49360

Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB

HighPUBLISHEDCNA: GitHub_M

Base score7.8 CVSS v4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:H/SA:N

02 Description

Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB

Published

2026-08-21 22:54Z2 HR AGO

Last updated

2026-08-21 22:54Z2 HR AGO

Reserved

2026-05-29

Assigning CNA

GitHub_M

Record state

PUBLISHED

Severity

High (CVSS 7.8)

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:H/SA:N

Weaknesses

SSVC decision

No CISA-ADP assessment

Data version

5.2

Document digest

4eeb8c3434d1a6d79412c27cdec643872a4544278e731be8ab06ce475c750f79

VendorProductVersionsPlatforms

DataReccerecce< 1.50.0—