Read the docs
TI-2026-74378 Aliases CVE-2026-77371

Redash DuckDB query runner lets users read and write arbitrary files

Priority HIGH 75CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

Redash from 26.0.0 before 26.9.0 is affected. The DuckDB query runner creates connections with enable_external_access left at its default of true, an improper access control flaw (CWE-284). A user with query access to an administrator-created DuckDB data source can read files that the Redash process can read and can write files with its privileges. Reading application secrets such as REDASH_SECRET_KEY could enable forged sessions and authentication bypass.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py created connections with enable_external_access left at its default value of true. A user with query access to an administrator-created DuckDB data source could use native file-reading functions to retrieve files readable by the Redash process or use COPY TO to write files with that process's privileges. Reading application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY could also enable forged sessions and authentication bypass. This issue is fixed in version 26.9.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00525 44th percentileScored 2026-11-07
Fix Fixed redash (getredash): 26.9.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
getredashredash26.0.0 to before 26.9.026.9.0Patch availableCNA
  • redash Vendorgetredash Affected 26.0.0 to before 26.9.0 Fixed in 26.9.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:redash:redash:*:*:*:*:*:*:*:*——getredash
  • cpe:2.3:a:redash:redash:*:*:*:*:*:*:*:* Versions — — ·getredash

Remediation

Upgrade Redash to version 26.9.0, which fixes the issue. No vendor advisory identifier is listed in the sources.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA redash (getredash) Fixed in 26.9.0

Timeline

  1. 2026-10-15 Threatist record created from CVE-2026-77371

References

Other 3

  • TI-2026-74373 SQL injection in Redash Query Results parameter substitution CVSS 4.0HIGH 8.7
  • TI-2021-18031 Insecure default configuration CVSS 3.1HIGH 8.1
  • TI-2021-19587 Server-Side Request Forgery (SSRF) in Redash CVSS 3.1HIGH 8.8
  • TI-2020-10116 Havoc Research discovered an authenticated Server-Side Request Forgery (SSRF) via the… CVSS 3.1HIGH 7.2
  • TI-2021-19584 Vulnerability in Redash OAuth2 flows due to misuse of state field (should be a nonce) CVSS 3.1MEDIUM 6.8
  • TI-2026-25634 Redash: Open redirect vulnerability in post-login redirect handling CVSS 3.1MEDIUM 6.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences