Vulnerabilities

TI-2026-74378 CVE-2026-77371

Redash DuckDB query runner lets users read and write arbitrary files

HIGH 75

Redash is a package for data visualization and sharing.

CVSS 4.0CRITICAL 9.3 Network Low privileges No interaction EPSS 0.00525 Published 2026-10-14 Fixed in 26.9.0 CWE-284

TI-2026-74377 CVE-2026-76083

LOW 23

Redash is a package for data visualization and sharing.

CVSS 4.0MEDIUM 4.9 Network Low privileges No interaction EPSS 0.00414 Published 2026-10-14 Fixed in 26.9.0 CWE-918

TI-2026-74373 CVE-2026-42093

HIGH 73

Redash is a package for data visualization and sharing.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00684 Published 2026-10-14 No fix listed CWE-89

TI-2026-25634 CVE-2026-33213

LOW 27

Redash is a package for data visualization and sharing.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00307 Published 2026-07-15 No fix listed CWE-601

TI-2021-19587 CVE-2021-43780

MEDIUM 40

Redash is a package for data visualization and sharing.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01038 Published 2021-11-23 No fix listed CWE-918

TI-2021-18031 CVE-2021-41192

MEDIUM 46

Redash is a package for data visualization and sharing.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.08143 Published 2021-11-23 No fix listed CWE-1188

TI-2021-19584 CVE-2021-43777

LOW 30

Redash is a package for data visualization and sharing.

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00306 Published 2021-11-23 No fix listed CWE-352

TI-2020-18468 CVE-2020-36144 · GHSA-j9jc-frfv-jf2p

LOW 26

Redash 8.0.0 is affected by LDAP Injection.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00934 Published 2021-03-18 No fix listed CWE-74

TI-2020-10116 CVE-2020-12725 · GHSA-h4v9-xq3w-85jp

LOW 34

Havoc Research discovered an authenticated Server-Side Request Forgery (SSRF) via the "JSON" data source of Redash open-source 8.0.0 and prior.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01318 Published 2020-06-11 No fix listed CWE-918