CVE-2026-77371

CriticalCVSS 9.3

Published: 14/10/2026(UTC)Updated: 14/10/2026(UTC)Translated: 15/10/2026(UTC)NVD NIST

Summary

In Redash from 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py created connections with enable_external_access left at its default value of true. A user with query access to an administrator-created DuckDB data source could use native file-reading functions to retrieve files readable by the Redash process or use COPY TO to write files with that process's privileges. Reading application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY could also enable forged sessions and authentication bypass.

Risk Assessment

The vulnerability allows an authenticated user to read and write files in the context of the Redash process, including theft of application secrets and authentication bypass. This poses a high risk to system confidentiality and integrity.

Recommendation

Immediately update Redash to version 26.9.0 or later. Until patched, restrict access to DuckDB data sources and rotate application secrets.

Other vulnerabilities in Redash

CVE-2026-33213Medium
A vulnerability in Redash from version 5.0.2 to 26.3.0 allows an open redirect attack. The get_next_path() function fails to normalize multiple leading slashes in the next parameter, enabling redirection of authenticated users to an external attacker-controlled site.

Original NVD description (English source)

Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py created connections with enable_external_access left at its default value of true. A user with query access to an administrator-created DuckDB data source could use native file-reading functions to retrieve files readable by the Redash process or use COPY TO to write files with that process's privileges. Reading application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY could also enable forged sessions and authentication bypass. This issue is fixed in version 26.9.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS