CVE-2026-33213
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A vulnerability in Redash from version 5.0.2 to 26.3.0 allows an open redirect attack. The get_next_path() function fails to normalize multiple leading slashes in the next parameter, enabling redirection of authenticated users to an external attacker-controlled site.
Risk Assessment
The risk involves potential credential theft or malware infection by redirecting users after login to a crafted malicious site controlled by the attacker.
Recommendation
Upgrade Redash to version 26.3.1 or later, which includes a fix that normalizes paths in the next parameter.
Other vulnerabilities in Redash
See all- CVE-2026-42093High
Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/query_runner/query_results.py accepts param_query_N_{key=value} parameters and passed attacker-controlled values to replace_query_parameters() for raw substitution into a referenced query's SQL. This path bypassed the ParameterizedQuery schema validation used by normal query execution and omitted the is_safe permission check. An authenticated user with at least view-only access to both the Query Results data source and the referenced data source could therefore inject SQL through text parameters and execute it with the referenced data source's privileges. This issue is fixed in version 26.9.0.
- CVE-2026-77371Critical
In Redash from 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py created connections with enable_external_access left at its default value of true. A user with query access to an administrator-created DuckDB data source could use native file-reading functions to retrieve files readable by the Redash process or use COPY TO to write files with that process's privileges. Reading application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY could also enable forged sessions and authentication bypass.
Original NVD description (English source)
Redash is a package for data visualization and sharing. From 5.0.2 to 26.3.0, the get_next_path() function in Redash's authentication module stripped the scheme and netloc from user-supplied next parameters but did not normalize multiple leading slashes, allowing a crafted login URL such as /login?next=////evil.com to redirect users to an external attacker-controlled site after authentication.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS