DataRecce recce vulnerabilities

Latest DataRecce recce CVEs

Newest publication first

1. CVE-2026-49360 Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB

   Published 2026-08-21

   High·CVSS 7.8 EPSS 1.1%

   Recce is a data-validation toolkit for enhanced dbt (data build tool) PR review. Prior to version 1.50.0, OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When R...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.