CVE-2026-77371
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
In Redash from 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py created connections with enable_external_access left at its default value of true. A user with query access to an administrator-created DuckDB data source could use native file-reading functions to retrieve files readable by the Redash process or use COPY TO to write files with that process's privileges. Reading application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY could also enable forged sessions and authentication bypass.
Risk Assessment
The vulnerability allows an authenticated user to read and write files in the context of the Redash process, including theft of application secrets and authentication bypass. This poses a high risk to system confidentiality and integrity.
Recommendation
Immediately update Redash to version 26.9.0 or later. Until patched, restrict access to DuckDB data sources and rotate application secrets.
Other vulnerabilities in Redash
See all- CVE-2026-76083Medium
In Redash from 10.0.0 until 26.9.0, the JSON data source query runner in redash/query_runner/json_ds.py used _get_all_results() to combine its configured base_url with a user-supplied query URL by using urljoin. An absolute query URL replaced the configured base URL instead of remaining under it, allowing a user with execute_query permission to direct a server-side request to an arbitrary external origin, and when HTTP Basic Auth was configured, the request also forwarded those credentials. This issue is fixed in version 26.9.0.
- CVE-2026-42093High
Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/query_runner/query_results.py accepts param_query_N_{key=value} parameters and passed attacker-controlled values to replace_query_parameters() for raw substitution into a referenced query's SQL. This path bypassed the ParameterizedQuery schema validation used by normal query execution and omitted the is_safe permission check. An authenticated user with at least view-only access to both the Query Results data source and the referenced data source could therefore inject SQL through text parameters and execute it with the referenced data source's privileges. This issue is fixed in version 26.9.0.
- CVE-2026-33213Medium
A vulnerability in Redash from version 5.0.2 to 26.3.0 allows an open redirect attack. The get_next_path() function fails to normalize multiple leading slashes in the next parameter, enabling redirection of authenticated users to an external attacker-controlled site.
Original NVD description (English source)
Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py created connections with enable_external_access left at its default value of true. A user with query access to an administrator-created DuckDB data source could use native file-reading functions to retrieve files readable by the Redash process or use COPY TO to write files with that process's privileges. Reading application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY could also enable forged sessions and authentication bypass. This issue is fixed in version 26.9.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS