Unauthenticated Remote Code Execution in Survey Routing Logic

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by supplying a crafted file-path/stream parameter during import handling. If successfully exploited, this could allow the attacker to remotely execute arbitrary code on the REDCap server. The attacker does not have to be authenticated in order to exploit this, but exploitation requires knowledge of a valid public survey hash. This vulnerability exists in REDCap 13.3.0 and higher.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-90817 represents a critical unauthenticated remote code execution vulnerability affecting REDCap survey processing systems. The flaw exists in two attack vectors: improper routing validation in survey passthrough logic that allows attackers to access unintended controller routes from public survey contexts, and unsafe file-path/stream parameter handling during data import operations. With a CVSS score of 9.8, this vulnerability requires no authentication and can be exploited remotely, making it an immediate threat to any organization running vulnerable REDCap instances. Healthcare institutions, research facilities, and data collection operations are particularly at risk, as REDCap is widely used for clinical research and sensitive data management.

Casky's 323 matched security skills leverage Claude AI with extended reasoning to detect the exploitation patterns mapped to TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners using Casky would identify suspicious HTTP request manipulation attempts targeting survey controller endpoints, anomalous file-path parameters in import requests, and behavioral indicators of reconnaissance probing public survey contexts. The platform's skills would surface CWE-73 (External Control of File Name or Path) and CWE-94 (Improper Control of Generation of Code) violations by analyzing request patterns, payload structures, and execution flows. Security teams would see findings highlighting unauthorized route access attempts, crafted file parameters deviating from expected import schemas, and command injection indicators in stream processing—enabling rapid detection before successful code execution occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-90817.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-90817

Casky has 323 skills that investigate the attack patterns behind CVE-2026-90817. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn