REDCap Patches CVSS 9.8 Unauth RCE via Survey Route

CVE-2026-90817 is confirmed: a CVSS 9.8 unauthenticated remote code execution flaw in REDCap, a clinical research data management platform used at medical universities, hospitals, and research institutions globally. Coordinated disclosure by Securifera. A patch is available.

Attack path

The vulnerability involves two components. The survey passthrough routing module accepts crafted HTTP requests that reach controller routes outside the intended public-facing scope. The data import handler processes file-path and stream parameters without adequate restriction. Supplying crafted requests through the public survey entry point alongside malicious file-path or stream values gives unauthenticated attackers arbitrary code execution on the REDCap server.

No credentials required. The public survey context is the entry point.

Scope

REDCap instances hold clinical trial records, participant survey responses, and study outcome datasets. Successful exploitation gives full code execution on the host server.

Analysis: REDCap deployments at research hospitals may sit within broader institution networks. Actual post-exploitation scope depends on the hosting environment and network segmentation in place.

Remediation

Affected versions and patch details are in the Securifera advisory listing and the NVD entry for CVE-2026-90817. Apply the available patch. If patching is not immediately possible, restricting public access to the survey passthrough routing endpoint reduces exposure until the fix can be deployed.

Related coverage: Icinga 2 Patches CVSS 9.8 Auth Bypass, ScreenConnect Worm Exploiting CVE-2026-84869, MISP CLI Exposes Auth Credentials via CVE-2026-90895.