16 matches found
recce
recce Pentest enumeration, vulnerability triage, exploitation...
CVE-2026-49360
Recce is a data-validation toolkit for enhanced dbt data build tool PR review. Prior to version 1.50.0, OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured...
CVE-2026-49360 Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB
Recce is a data-validation toolkit for enhanced dbt data build tool PR review. Prior to version 1.50.0, OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured...
CVE-2026-49360 Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB
Recce is a data-validation toolkit for enhanced dbt data build tool PR review. Prior to version 1.50.0, OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured...
cdbt (>=0.4.13, <=0.4.26), mdbt (>=0.4.27, <=0.6.2) potentially affected by CVE-2026-49360 via recce (0.35.0)
recce PYPI version 0.35.0 is affected by a known vulnerability. The following packages have a transitive dependency on recce and may be impacted: - cdbt =0.4.13, =0.4.27, =0.6.2 Source cves: CVE-2026-49360 Source advisory: MEND:CVE-2026-49360...
CVE-2026-49360
Recce (a data-validation toolkit for dbt PR review) versions prior to 1.50.0 are vulnerable to unauthenticated SQL execution through the query run API when deployed with a DuckDB-backed project and exposed to an untrusted network without authentication. An attacker can leverage DuckDB filesystem ...
CVE-2026-49360
Recce is a data-validation toolkit for enhanced dbt data build tool PR review. Prior to version 1.50.0, OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured...
EUVD-2026-64204
Recce is a data-validation toolkit for enhanced dbt data build tool PR review. Prior to version 1.50.0, OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured...
CVE-2026-49360 Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB
Recce is a data-validation toolkit for enhanced dbt data build tool PR review. Prior to version 1.50.0, OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured...
CVE-2026-49360: External Control of File Name or Path
Recce is a data-validation toolkit for enhanced dbt data build tool PR review. Prior to version 1.50.0, OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured...
Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB
ImpactRecce OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API.When Recce is configured with a DuckDB-backed project, an attacker can use DuckDB filesystem primitives to read and...
cdbt (>=0.4.13, <=0.4.26), mdbt (>=0.4.27, <=0.6.2) potentially affected by CVE-2026-49360 via recce (0.35.0)
recce PYPI version 0.35.0 is affected by a known vulnerability. The following packages have a transitive dependency on recce and may be impacted: - cdbt =0.4.13, =0.4.27, =0.6.2 Source cves: CVE-2026-49360 Source advisory: OSV:PYSEC-2026-3049...
Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB
Impact Recce OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured with a DuckDB-backed project, an attacker can use DuckDB filesystem primitives to read and...
cdbt (>=0.4.13, <=0.4.26), mdbt (>=0.4.27, <=0.6.2) potentially affected by CVE-2026-49360 via recce (0.35.0)
recce PYPI version 0.35.0 is affected by a known vulnerability. The following packages have a transitive dependency on recce and may be impacted: - cdbt =0.4.13, =0.4.27, =0.6.2 Source cves: CVE-2026-49360 Source advisory: OSV:GHSA-RH62-J648-G5QC...
