CVE-2026-49360

This vulnerability exposes a dangerous escalation path in Recce's DuckDB integration. The tool exposes a query execution API with no authentication by default—a design choice optimized for developer friction reduction in internal dbt PR workflows. The problem: DuckDB's filesystem primitives (READ_*, WRITE_*, and related functions) give arbitrary file access to anything the Recce process can reach. Combined with unauthenticated network exposure, an attacker can read or write files as the Recce process user, including root in common container deployments. The blast radius is determined entirely by deployment topology, not code severity. A developer running `recce server` locally against their own project has contained exposure—damage is limited to their own filesystem. But every escalation from 'internal tool' to 'deployed service' exponentially expands what can be reached. The vulnerability doesn't care about developer intent; it follows the deployment context. The patch restricts unsafe file read/write behavior specifically in the DuckDB adapter layer, which indicates this was a local condition rather than an architectural inevitability—but the same vulnerability gene exists wherever powerful query engines with filesystem capabilities are composed with frictionless API exposure. Other warehouse adapters were reviewed for similar issues, suggesting the maintainers recognized this as a pattern rather than an isolated bug. The recommended mitigations—avoid public exposure, enable authentication, run as non-root, use read-only filesystems—are sound but face a structural problem: Recce's entire design philosophy is engineered to eliminate friction. You cannot simultaneously optimize for frictionless use and expect deployers to manually re-apply friction as security controls. The friction won't get applied, and the blast radius will reflect that. Assume this pattern repeats in other local-first data tooling in the dbt ecosystem. When evaluating similar developer productivity tools, probe the query engine's filesystem capabilities and ask: what happens when this composes with an unauthenticated API?

Reviewed through automated stages and approved by a human before publication.