CVE-2026-76083
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
In Redash from 10.0.0 until 26.9.0, the JSON data source query runner in redash/query_runner/json_ds.py used _get_all_results() to combine its configured base_url with a user-supplied query URL by using urljoin. An absolute query URL replaced the configured base URL instead of remaining under it, allowing a user with execute_query permission to direct a server-side request to an arbitrary external origin, and when HTTP Basic Auth was configured, the request also forwarded those credentials. This issue is fixed in version 26.9.0.
Risk Assessment
A user with execute_query permission can force SSRF requests to arbitrary external origins and potentially leak the data source's HTTP Basic Auth credentials.
Recommendation
Update Redash to version 26.9.0 or later and keep REDASH_ENFORCE_PRIVATE_IP_BLOCK enabled.
Other vulnerabilities in Redash
See all- CVE-2026-77371Critical
In Redash from 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py created connections with enable_external_access left at its default value of true. A user with query access to an administrator-created DuckDB data source could use native file-reading functions to retrieve files readable by the Redash process or use COPY TO to write files with that process's privileges. Reading application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY could also enable forged sessions and authentication bypass.
- CVE-2026-42093High
Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/query_runner/query_results.py accepts param_query_N_{key=value} parameters and passed attacker-controlled values to replace_query_parameters() for raw substitution into a referenced query's SQL. This path bypassed the ParameterizedQuery schema validation used by normal query execution and omitted the is_safe permission check. An authenticated user with at least view-only access to both the Query Results data source and the referenced data source could therefore inject SQL through text parameters and execute it with the referenced data source's privileges. This issue is fixed in version 26.9.0.
- CVE-2026-33213Medium
A vulnerability in Redash from version 5.0.2 to 26.3.0 allows an open redirect attack. The get_next_path() function fails to normalize multiple leading slashes in the next parameter, enabling redirection of authenticated users to an external attacker-controlled site.
Original NVD description (English source)
Redash is a package for data visualization and sharing. From 10.0.0 until 26.9.0, the JSON data source query runner in redash/query_runner/json_ds.py used _get_all_results() to combine its configured base_url with a user-supplied query URL by using urljoin. An absolute query URL replaced the configured base URL instead of remaining under it, allowing a user with execute_query permission to direct a server-side request to an arbitrary external origin. When HTTP Basic Auth was configured for the data source, the request also forwarded those credentials to the selected origin. Private and internal address access remained constrained when REDASH_ENFORCE_PRIVATE_IP_BLOCK was enabled. This issue is fixed in version 26.9.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS