CVE-2026-90817 — REDCap Unauthenticated RCE (Survey __passthru / Data Import)

Overview

CVE-2026-90817 affects REDCap (Research Electronic Data Capture), a widely deployed web platform used for clinical and research data collection. Public research describes an unauthenticated remote code execution chain involving:

• A public survey entry point (parameter s= / survey hash)
• __passthru request routing into Data Import components
• Unsafe path / stream handling in import-related code paths

This entry on pocbit.org hosts a Python 3 verification and research tool aligned with community write-ups (including version floor checks and passthru probing). It is not a substitute for vendor advisories or your own patch verification.

Affected versions

Community summaries reference:

| Branch | Fixed at or above | |--------|-------------------| | 16.x | 16.0.49 | | 17.3.x | 17.3.10 | | 17.4.x | 17.4.4 |

Installations ≥ 13.3.0 on affected code paths may be vulnerable until the corresponding vendor fix is applied. Always confirm against the official REDCap security notice and your deployed build string—not this page alone.

Attack prerequisites

Typical discussion of this flaw assumes:

1. REDCap is reachable over the network (often HTTPS on an institutional host).
2. A valid public survey link exists (surveys/index.php?s=<hash>). Many check modes require that hash; scanning random hosts without authorization is out of scope for legitimate use.
3. Vulnerable routing to Data Import handlers via __passthru (exact parameter names may vary; the bundled tool probes common routes).

What the bundled tool does

The downloadable script supports two modes:

• check — Fingerprint REDCap, parse version, validate survey reachability, probe __passthru routes (recommended default).
• exploit — Runs only when a verified exploit_chain.json is supplied. Public sources noted (as of publication) that the full HTTP/RCE chain was not fully disclosed; exploit mode is for authorized labs once chain details are confirmed.

Mass scanning flags (--list, threading) are intended for inventory you own or explicit written scope—not open internet spraying.

Impact

Successful exploitation in a vulnerable configuration implies integrity and confidentiality loss on the application server (typical RCE impact: code execution as the web user, lateral movement, data exfiltration). REDCap often holds sensitive research and PHI—treat patching as urgent where exposure exists.

Remediation

1. Upgrade REDCap to a patched release per vendor guidance (see version table above).
2. Restrict network access to REDCap admin and survey interfaces where possible (VPN, allowlists).
3. Audit surveys — disable or rotate public survey links that are no longer needed.
4. Monitor logs for anomalous __passthru, Data Import, or survey access patterns.

Legal and ethical use

Use this PoC only on systems you own or have written permission to test. Unauthorized access to REDCap instances (including university medical research environments) may violate law and policy.

References

• Search CVE-2026-90817 on NVD and the CVE Program for canonical metadata.
• Follow REDCap / Vanderbilt security communications for official fixed versions and mitigation steps.